@tootallnate/once

Maintainerscaution

Only one registry account has publish access. The repository is user-owned rather than organization-backed, so there is no provided project-backing evidence to offset the thin publishing base.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which is a maintenance concern, although the latest release and repository push show recent publication activity.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security scanning tools were detected; this is a modest transparency and maintenance gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unspecified; this is a minor transparency gap for a small package.

Workflow auditcaution

Both workflows were analyzed without trigger or untrusted-checkout sinks, and one scopes permissions read-only. However, all 7 action references are unpinned and the release workflow has a high-confidence low-severity adhoc-package finding.