@types/async

Build provenancecaution

No build attestation or trusted publisher provenance is present, leaving a publication-transparency gap, but this is not by itself evidence of poor maintenance.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions, but two workflows lack top-level permission declarations, leaving a modest least-privilege gap.