fast-fifo

Build provenancecaution

The release has no build attestation or trusted-publisher record, so registry publication cannot be independently tied to a verified build. This is a transparency gap, partly offset by the package's small, dependency-free artifact.

Release historycaution

The latest release was over three years ago, with no releases in the past 12 months. The six-release history and stable version reduce concern, but the prolonged release gap indicates limited ongoing maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the past three months. It is not archived and was pushed in May 2024, which provides some evidence that abandonment is not definitive.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted triggers, but both of its two action references are unpinned. This is a reproducibility and dependency-hygiene weakness rather than a severe risk on its own.