apollo-utilities

Release historydanger

The latest registry release was May 2020, with no releases in the last 12 months; this is a substantial freshness and abandonment concern despite the long release history.

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent.

Lifecycle scriptscaution

A prepare script runs during installation, adding build-time installation behavior that deserves some caution even though no broader workflow evidence shows it is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so ownership of this exact package is less transparent; this may reflect a monorepo subpackage but remains a caution.

Workflow auditcaution

Five high-confidence findings report blanket GitHub App permissions, which is a genuine workflow hygiene concern; two low-severity findings install packages outside lockfiles. No untrusted checkouts, script injection, or unpinned actions were found.