@types/lodash.mergewith

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, but it is not enough to outweigh the active, established source project.

Release historycaution

The package has existed for about 10 years but has had no registry release in nearly three years. Active repository maintenance partly offsets the stale package cadence, since type definitions may only require releases when declarations change.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and there are no untrusted checkouts or script injections. Four medium-confidence template-injection findings are hygiene concerns, but no dangerous trigger or write-wide token combination corroborates them.