lodash.padstart

Release historycaution

The package has had no registry release in about 10 years, despite 11 historical releases. This raises release-specific freshness and abandonment concerns, although the linked project remains active.

Repo package mentioncaution

The repository name does not match lodash.padstart and its README does not mention the package, so the package-to-repository relationship is less transparent than ideal. A monorepo can explain the name mismatch, but the missing mention remains a caution.

Workflow auditcaution

All 8 workflows were analyzed with no untrusted checkout, script injection, top-level write permission, or unpinned action findings. Three high-confidence low-severity findings involve installing packages outside a lockfile, so this is a minor hygiene concern.