@protobufjs/pool

Release historycaution

The package has had no registry release in roughly 9 years, with the latest release on January 25, 2017. Active repository work partly compensates for package-level release staleness, but the published artifact is still old.

Repo bus factorcaution

One contributor made about 76% of recent commits, creating concentration risk, though seven other contributors were active during the same period.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @protobufjs/pool, so the package-to-repository relationship is not clearly demonstrated. The mismatch may reflect a monorepo, but the missing README mention remains a transparency concern.

Repo toolingcaution

The project uses TypeScript, npm scripts, and Gulp, but no security scanning tools were detected. This is a modest process gap rather than evidence of abandonment.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the release workflow has top-level write permissions. The audit also found high-confidence lockfile-bypassing installs; the cache-poisoning finding is low confidence, so it is hygiene rather than a severe conclusion.