@mjackson/node-fetch-server

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months, reinforcing that maintenance has stopped rather than merely slowed.

Repository archiveddanger

The linked repository is archived, a severe abandonment warning even though it was pushed in October 2025; archived status outweighs its popularity and otherwise complete source tree.

Workflow auditdanger

The publish workflow has a high-confidence template-injection finding, which can allow attacker-controlled text to expand into code; the low-confidence cache-poisoning finding is only hygiene and adds little weight.

Project backingcaution

The package and repository are owned by the same individual account, so the source linkage is consistent; this provides no organizational maintenance buffer.

Release historycaution

The package has nine releases over about two years, but none in the last 12 months; the earlier short median interval does not compensate for the current release gap.