lodash.assign

Release historycaution

The latest registry release was published about 10 years ago, with no releases in the last 12 months. Active repository work partly offsets the age of this release, but the package itself has a long release gap.

Repo package mentioncaution

The linked repository name does not match lodash.assign and its README does not mention the package, creating some uncertainty about the exact package-to-repository relationship. The organization-backed lodash repository makes a monorepo subpackage explanation plausible, but does not remove the mismatch.

Type declarationscaution

No type declarations are included for this JavaScript library, which makes typed integration less convenient. This is a consumer-ergonomics gap rather than evidence of abandonment.

Workflow auditcaution

All 8 workflows were analyzed, with no untrusted checkout or script-injection paths and all 20 action references pinned. Three high-confidence low-severity adhoc-package findings are limited workflow hygiene concerns.