@yarnpkg/lockfile

Release historydanger

The package has had no release in the last seven years, despite a previously regular release interval, which materially raises maintenance and abandonment concerns.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, a significant sign that maintenance has slowed or stopped.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less transparent than modern releases.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, indicating little current project activity; the large backlog further limits this as evidence of active maintenance.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected, leaving a supply-chain hygiene gap.