@protobufjs/float

Release historycaution

The latest registry release was April 2, 2017, with no releases in the last 12 months. Active upstream work partly offsets the stale published artifact, but consumers are adopting an old release.

Repo bus factorcaution

One contributor made about 76% of recent commits, creating concentration risk. Seven other contributors were active, and organization ownership provides some ability to hand maintenance off.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package-to-source identity is less transparent. The organization-owned monorepo context partly explains the mismatch but does not remove the traceability gap.

Repo toolingcaution

The project uses TypeScript, npm scripts, and Gulp, indicating an established build process. No security scanning tools were detected, which is a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, but all 12 action references are unpinned and one workflow grants top-level write access. Low-confidence cache-poisoning and high-confidence ad hoc package installation findings add hygiene concerns.