@formatjs/fast-memoize

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some uncertainty about package ownership. The matching @formatjs namespace and organization-owned repository make a monorepo sub-package explanation plausible, so this remains a caution rather than a danger.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected. This is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This reduces transparency for vulnerability reporting, though active maintenance and other release evidence partly offset the gap.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted-checkout or script-injection triggers, and seven scope permissions at job level. However, 76 of 79 action references are unpinned, and high-confidence template-injection findings plus medium-confidence bot-condition findings warrant workflow hygiene attention; without dangerous triggers or exposed broad write permissions, this is not a severe health risk.