@apollo/cache-control-types

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be. This is a transparency gap rather than evidence that the release is unsafe.

Release historycaution

The package has had no registry release in roughly three years, and only four releases overall. Active repository work partly offsets abandonment risk, but the published package itself is stale.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, so package ownership is less transparent even though the repository is the expected organization monorepo context.