d3-fetch

Release historycaution

The package has 13 releases over nearly 10 years, but none in the last five years; that is a meaningful maintenance concern for a dependency despite its historically steady cadence.

Repo commit activitycaution

There were no commits from active maintainers in the last three months, consistent with the old latest release and indicating limited current maintenance.

Repo toolingcaution

The repository uses Rollup for builds, but no security scanning tools were detected; the build setup is established while security automation is limited.

Security policycaution

The repository has no published security policy, which reduces transparency for reporting and handling vulnerabilities, though this is a hygiene gap rather than evidence of abandonment by itself.

Workflow auditcaution

The single workflow was fully analyzed with no detected injection or high-severity findings, but both action references are unpinned, leaving avoidable build reproducibility and action-update risk.