lodash.mapvalues

Release historycaution

The package has had no registry release in nearly 10 years, despite 16 historical releases; this is a meaningful staleness concern for the specific release.

Repo package mentioncaution

The repository name does not match lodash.mapvalues and its README does not mention the package, so the linkage is less transparent; this may be an ordinary monorepo subpackage but remains a genuine caution.

Workflow auditcaution

All eight workflows were analyzed with no untrusted checkout, script injection, top-level write permissions, or unpinned actions; three high-confidence low-severity findings install packages outside a lockfile, so this is a modest hygiene concern.