lodash.reduce

Release historycaution

The package has 24 releases, but none in the last 12 months and its latest release was in August 2016, roughly 10 years ago. The active linked repository partly offsets this, but the release itself is substantially stale.

Repo package mentioncaution

The repository name does not match lodash.reduce and its README does not mention the package. This is consistent with a monorepo sub-package, but the missing explicit mention leaves a small provenance and package-ownership transparency gap.

Token permissionscaution

Six workflows lack top-level permissions declarations, which is a workflow-hardening gap. However, none declares top-level write permissions and two explicitly use read-only permissions, limiting the concern.