@alloc/quick-lru

Release historycaution

Only two releases have been published since April 2021, with roughly 5 years and 5 months between releases, so the package has a sparse release history despite a recent release.

Repo bus factorcaution

All 11 recent commits came from one contributor, leaving maintenance dependent on a single person.

Repo toolingcaution

No build tool or security scanning tool was detected, leaving the project with limited automated engineering and security coverage.

Workflow auditcaution

The only workflow is fully analyzed and has no untrusted checkout or script-injection findings, but it grants top-level write permissions, leaves both actions unpinned, and high-confidence auditing found an ad hoc package installation. These are workflow hygiene and supply-chain concerns, not severe risks on their own.