is-npm

Project backingcaution

The repository is owned by the named individual sindresorhus rather than an organization, so the single registry maintainer reflects a genuinely narrow maintainer base.

Release historycaution

The package is mature, with releases since 2014, but only seven releases overall, no releases in the last 12 months, and a median interval of about 422 days indicate a deliberately slow cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which limits evidence of ongoing maintenance despite the recent repository push.

Repo toolingcaution

The repository has no detected build or security-scanning tools. For this small package that is a hygiene limitation rather than a severe dependency risk.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or unsafe trigger sinks, but both action references are unpinned, leaving avoidable supply-chain drift risk.