lodash.capitalize

Release historycaution

The package has had no registry release in nearly 10 years, which limits confidence that this exact release receives updates. The linked repository is still active, partly compensating for the stale package publication.

Repo package mentioncaution

The repository name does not match lodash.capitalize and its README does not mention the package, so the package-to-source link is less transparent. The organization-owned monorepo context partly explains the mismatch but does not remove the caution.

Workflow auditcaution

All 8 workflows were analyzed, all 20 action references are pinned, and no untrusted checkout or script-injection paths were found. Three high-confidence low-severity adhoc-package findings are minor workflow hygiene concerns.