Public shared report
grammy@1.44.0
Probably fine for trusted packages; review the highlights.
36/100 WATCH
- Version
- 1.44.0
- Files scanned
- 45
- Dependencies
- 4
- Engine
- 0.4.2
Top findings
- Runs lifecycle scripts during installhigh +20
prepare: npm run backport
- Risky dependency in resolved treemedium +12
lifecycle-scripts, missing-provenance, single-maintainer
- Single maintainerlow +4
A single-maintainer package can be legitimate, but account compromise risk is concentrated.