@gar/promise-retry

Name lookalikedanger

The artifact has complete overlap with `retry`, which has far more downloads and stable releases, while this package neither identifies itself as a lookalike nor clearly explains that relationship. That makes mistaken adoption of the established package a serious risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern for a young package, with no provided activity signal compensating for it.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security scanning tools were detected. The build setup is a modest positive; the missing scanning lowers transparency somewhat.

Security policycaution

No security policy was found in the repository. This is a transparency gap, although it is not by itself evidence that the package is unsafe.

Workflow auditcaution

The workflow audit completed fully and found no injection or high-severity findings, with job-level permissions used. However, both action references are unpinned, leaving a supply-chain hygiene weakness.