@protobufjs/aspromise

Release historycaution

The latest registry release was in April 2017, with no releases in the last 12 months. This is a real freshness concern for the published package, although the linked repository is still active.

Repo bus factorcaution

Eight contributors were active in three months, but one contributor made about 76% of commits. Organization backing and several additional contributors partly reduce the concentration concern.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so package-to-repository ownership is less transparent. The mismatch can occur for a monorepo subpackage, but the lack of a README mention still warrants caution.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and Gulp for builds, but no security scanning tools were detected. The build tooling is established, while scanning coverage is a modest gap.

Workflow auditcaution

Both workflows were analyzed and have no untrusted checkouts or script injection findings, but all 12 action references are unpinned, one workflow grants top-level write permissions, and high-confidence adhoc package installs occur. The high-severity cache finding is low confidence and is treated as hygiene rather than a decisive risk.