@istanbuljs/load-nyc-config

Release historycaution

The latest release was published in May 2020, with no releases in the last 12 months despite the package being over six years old. This is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old registry release, this indicates a thin current maintenance signal.

Repo issue activitycaution

There are open issues and pull requests, but none were opened or merged in the last month. This supports the broader concern about limited current maintenance.

Repo toolingcaution

No build tool or security scanning tool was detected. For a small JavaScript package this is a hygiene gap, but it is less significant than the release and commit history.

Workflow auditcaution

All seven action references are unpinned and one workflow grants top-level write access, both of which weaken workflow reproducibility and least privilege. The cache-poisoning finding has low confidence, so it is hygiene rather than a severe risk here.