lodash.assignin

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a transparency gap rather than evidence that the release is unsafe.

Release historycaution

The package has had no registry release in nearly 10 years, despite 12 releases early in its history. That makes this specific release stale, although the linked upstream repository remains active.

Repo package mentioncaution

The linked repository name does not match lodash.assignin and its README does not mention the package, so the association is not clearly demonstrated even though a monorepo subpackage mismatch can be ordinary.

Workflow auditcaution

All 8 workflows were analyzed, all 20 action references are pinned, and there are no untrusted checkouts or script injections. Three high-confidence low-severity findings report packages installed outside a lockfile, which is a minor hygiene concern.