@parcel/utils

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last 3 months. This is a meaningful maintenance warning despite the package's long release history.

Repo issue activitycaution

Issues and pull requests still receive activity, but none of the 8 pull requests opened in the last month were merged. That suggests slower current execution than the release history alone indicates.

Repo package mentioncaution

The repository name does not match @parcel/utils and its README does not mention the package, creating a provenance-transparency gap. The organization backing and monorepo context partly compensate, but the mismatch remains worth checking.

Security policycaution

The linked repository has no security policy. This weakens vulnerability-reporting transparency, though Dependabot is present as compensating security tooling.

Workflow auditcaution

All 49 analyzed action references are unpinned, and high-confidence template-injection and secrets-inherit findings affect release workflows. The audit found no untrusted checkout or script-injection path, so this is workflow hygiene risk rather than a standalone severe verdict.