http-proxy-agent

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, a real maintenance concern; the recent registry release and repository push provide some counterevidence but do not show sustained development.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about the linkage; the substantial monorepo file tree partly explains why a subpackage name may differ.

Repo toolingcaution

The repository uses TypeScript, npm scripts, Vitest, and Turborepo, showing a structured build and test setup; no security scanning tool was detected, which is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting guidance unclear for a network-facing package.

Token permissionscaution

Neither workflow declares top-level token permissions, and only one uses job-level permissions; although no top-level write access was found, the permission posture is less explicit than preferred.