@supercharge/promise-pool

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a hygiene gap, not evidence that the release is unsafe.

Repo commit activitycaution

The repository had zero commits from active maintainers in the last three months. The recent release and push date compensate partly, but the quiet development window lowers maintenance confidence.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no repository security-scanning tools were detected. This is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, which weakens build reproducibility and warrants a minor caution.