lodash._baseassign

Release historycaution

The latest release was published about 11 years ago, with no releases in the last 12 months. This is a meaningful freshness and abandonment concern, though the linked source repository remains active.

Repo package mentioncaution

The repository name does not match the package and its README does not mention lodash._baseassign, creating some uncertainty about package-to-source alignment. Its placement under the lodash organization partly offsets that concern because this may be a monorepo subpackage.

Workflow auditcaution

All 8 workflows were analyzed with no dangerous triggers, script injection, or unpinned action references. Three high-confidence low-severity adhoc-package findings are a minor workflow hygiene concern.