@sindresorhus/merge-streams

Release historycaution

The latest registry release was over two years ago, with no releases in the last 12 months. This is a meaningful freshness concern despite the package having 11 releases overall.

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance dependent on a single active person. The repository is user-owned rather than organization-owned, so there is no provided backing signal to offset that concentration.

Repo commit activitycaution

There was one commit in the last three months, showing some recent maintenance, but the activity level is modest relative to the package's long release gap.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected. This is a minor process gap rather than a direct dependency risk.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both action references are unpinned, weakening build reproducibility and making this a small workflow-hygiene concern.