web-artifacts-builder

SUSPICIOUS. The stated purpose and capabilities mostly align with a frontend artifact builder, and the referenced ecosystems are legitimate. However, the real execution path is hidden inside local shell scripts that can install packages and perform other actions not visible here, so install trust is only partial. This is not overtly malicious, but the opaque script-based workflow and unpinned npm dependency installation make it medium risk.