async-listen

Build provenancecaution

No build provenance attestation or trusted publisher identity is available, leaving publication origin less independently verifiable.

Release historycaution

The package has existed for about 10 years with 11 releases, but it has had no registry release in the last 12 months; this indicates limited recent release momentum rather than abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which is the main evidence of reduced current maintenance momentum, although the recent repository push provides some compensating evidence.

Token permissionscaution

Neither workflow declares top-level token permissions, so the repository does not explicitly document least-privilege defaults; no workflow requests top-level write access.