array.prototype.findlastindex

Build provenancecaution

This release has no build attestation or trusted-publisher identity, so consumers cannot independently verify how the registry artifact was produced. The package's repository, license, tests, and release history provide transparency but do not replace provenance.

Release historycaution

The package has existed for about 5 years with 10 releases and a median interval of about 160 days, but it has had no release in the last 12 months. This indicates a mature but currently quiet project rather than clear abandonment.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which lowers confidence in ongoing maintenance. The recent 2025 release and intact repository provide some compensating evidence.

Repo toolingcaution

The repository reports no build tool and no security-scanning tool. This is a hygiene gap for release assurance, though the small, straightforward polyfill has tests and a visible source tree.

Workflow auditcaution

All five workflows were analyzed without failed files or audit findings, and the pull_request_target workflows have no untrusted checkout or script-injection sinks. However, all five action references are unpinned, leaving avoidable build reproducibility and action-update risk.