lodash.castarray

Build provenancecaution

No build provenance attestation or trusted-publisher configuration is present. This limits publication transparency, but it is not a severe health issue given the other project evidence.

Release historycaution

This package has only one release, published about 10 years ago, with no releases in the last 12 months. The active upstream repository provides some compensating maintenance context, but this individual package release is stale.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package. A name mismatch is normal for a monorepo, but the lack of any README mention leaves some uncertainty that this repository corresponds to the published package.

Type declarationscaution

No type declarations are included. This is a minor ergonomics gap for typed consumers, but it does not by itself indicate abandonment or unsafe maintenance.

Workflow auditcaution

All eight workflows were analyzed, all 20 action references are pinned, and no dangerous trigger or untrusted checkout pattern was found. Three high-confidence low-severity adhoc-package findings are hygiene concerns only.