cross-fetch

Build provenancecaution

The release has no build attestation, staged publishing, or trusted-publisher identity. This weakens publication transparency but does not by itself show that the release is unsafe.

Lifecycle scriptscaution

A prepare script runs during package installation, adding some installation complexity. No other lifecycle-script evidence is provided, so this is a modest concern rather than a severe risk.

Release historycaution

The package has 52 releases over roughly 9 years, but none in the last 12 months; its latest registry release was in December 2024. This points to slowing maintenance rather than abandonment by itself.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with no recent registry releases, this lowers confidence in current maintenance capacity.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with 24 open issues and 3 open pull requests. This is a mild sign of limited current activity, though not proof of abandonment.