isomorphic-unfetch

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers have less assurance about how this release artifact was produced.

Release historycaution

The package has had no release in more than three years, which is a meaningful maintenance concern even though its release history was previously established.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and raising abandonment risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures less transparent.

Workflow auditcaution

Both workflows were analyzed with no audit findings and no untrusted checkouts or injection sinks, but all six action references are unpinned, leaving them exposed to moving upstream versions.