function-timeout

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable; this is a transparency limitation rather than a verdict on the package.

Release historycaution

The package has five releases over roughly four years, but none in the last two years, which is meaningful evidence of limited ongoing maintenance for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the possibility that maintenance has slowed or stopped.

Workflow auditcaution

All workflows were analyzed with no audit findings, no untrusted checkout or script-injection paths, and no broad top-level write permissions. However, both action references are unpinned, leaving avoidable workflow supply-chain exposure.