lodash.defaultsdeep

Build provenancecaution

No build provenance attestation or trusted publisher identity is provided, leaving publication origin less transparent.

Release historycaution

The package has had no registry release in about 7 years, despite 20 releases since 2015. This is a meaningful freshness concern for the specific release, though the linked project remains active.

Repo package mentioncaution

The repository name does not match this package and its README does not mention lodash.defaultsdeep, so the package's direct connection to the linked monorepo is less transparent. The name mismatch alone is ordinary for a monorepo subpackage, but the missing mention warrants caution.

Token permissionscaution

Six workflows lack top-level permission declarations, which is a workflow-hygiene gap, but none declares top-level write permissions and two explicitly use read-only permissions.

Type declarationscaution

No type declarations are published, which can reduce integration ergonomics for TypeScript consumers, but this is a small concern for a focused JavaScript utility package.