collection-visit

Release historydanger

The package has 7 releases since July 2015, but none in the last 12 months and its latest release was in April 2017. This is strong evidence of a long-stable or abandoned release line, with no newer release to demonstrate active maintenance.

Build provenancecaution

The release has no build attestation, trusted publisher, or staged-publishing evidence. This limits publication transparency, but the package is a small JavaScript artifact with a simple four-file package tree.

Dependency profilecaution

The package has two runtime dependencies, map-visit and object-visit, so adoption also depends on their maintenance and supply-chain health. The dependency count is modest rather than excessive.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. The repository is not archived, but the absence of recent work reinforces the package's stale maintenance profile.

Security policycaution

The linked repository has no security policy, so there is no documented channel or process for reporting vulnerabilities. This is a transparency and incident-response gap, though it is less severe for this small utility package.