@lerna/create

Registry deprecationdanger

The package is deprecated at package scope because it is an implementation detail of Lerna and is no longer published separately. This directly undermines its suitability as a standalone dependency despite the active source project.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency gap rather than evidence of an unsafe release.

Dependency profilecaution

The package declares 67 runtime dependencies, creating a broad dependency surface for a command implementation. The profile raises maintenance complexity but is partly consistent with a substantial CLI component.

Repo package mentioncaution

The repository name does not match @lerna/create and its README does not mention the package. This is plausible for a monorepo subpackage, but the missing explicit reference leaves some package-to-repository provenance ambiguity.

Security policycaution

The repository has no security policy. This weakens disclosure transparency, although active maintenance and repository security scanning provide partial compensation.