y18n

Lifecycle scriptscaution

A prepare install-time script adds some build-time supply-chain exposure, although the package has zero runtime dependencies and the repository shows standard build tooling.

Release historycaution

The package has 22 releases since 2015, but the registry shows no release in about 5 years, which raises a currency concern despite recent repository activity.

Repo bus factorcaution

All 6 recent commits came from one contributor, creating a real continuity risk, though the repository is owned by an organization that can provide some handoff capacity.

Repo toolingcaution

The project uses TypeScript, npm scripts, and Babel for builds, but no security scanning tools were detected, leaving a modest assurance gap.

Token permissionscaution

Neither workflow declares top-level token permissions, so the repository has weaker explicit least-privilege controls even though no workflow requests top-level write access.