@whatwg-node/node-fetch

Repo bus factorcaution

Four contributors were active in three months, but one contributor made about 84% of commits. That concentration creates some continuity risk because the repository owner is an individual.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Version stabilitycaution

Version 0.9.1 is not a stable major release, and 95% of recent releases are prereleases, which increases compatibility uncertainty for dependents.

Workflow auditcaution

All five workflows were analyzed, with no untrusted checkout or script-injection paths. However, four high-confidence findings identify unpinned container images, leaving build inputs less reproducible and requiring workflow hygiene improvements.