lodash._isiterateecall

Release historycaution

The package has had no release in about 11 years, which raises version-staleness and abandonment concerns, although the linked project still shows recent activity.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, so package ownership is less transparent; this may be normal for a monorepo subpackage but remains a caution.

Workflow auditcaution

All 8 workflows were analyzed with no untrusted checkouts or script injection and all 20 action references are pinned. Three high-confidence low-severity findings install packages outside a lockfile, which is a minor hygiene concern.