lodash.once

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, but this is not by itself evidence of an unhealthy project.

Release historycaution

The latest registry release was about 10 years ago, with no releases in the last 12 months. That is a meaningful freshness concern for this exact release, although the repository remains active.

Repo package mentioncaution

The repository name does not match lodash.once and its README does not mention the package, so the link does not clearly establish that this repository publishes or maintains this exact package.

Workflow auditcaution

All 8 workflows were analyzed, all 20 action references are pinned, and no dangerous trigger or untrusted checkout findings were found. Three high-confidence low-severity adhoc-package findings are hygiene concerns, not a severe workflow risk.