@bundled-es-modules/deepmerge

Name lookalikedanger

The package explicitly describes itself as a mirror of `deepmerge`, while the established package has 46 stable releases and about 354 million monthly downloads versus this package's 2 releases and about 5.9 million downloads. That identity overlap can cause developers to select the wrong package, so it is a severe dependency risk.

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available. This does not establish a malicious release, but it limits transparency about how the artifact was produced.

Release historycaution

The package has only 2 releases over roughly 3 years, with a median interval of about 2 years and 11 months, although one release occurred in the last 12 months. This indicates limited release activity and a thin maintenance track record.