lru-cache

Build provenancecaution

This release has no build attestation or trusted-publisher provenance, leaving publication integrity less transparent than a release with verifiable build evidence.

Repo bus factorcaution

All 2 recent commits came from one contributor, isaacs, giving the project a concentrated maintenance base despite its long release history.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, although the package had 18 releases in the last year and the repository was recently pushed; this is a modest maintenance concern rather than abandonment evidence.

Workflow auditcaution

The audit analyzed all 3 workflows with no detected sinks or findings, but all 9 action references are unpinned and one workflow grants top-level write access; these are workflow hygiene and reproducibility concerns, not severe risks on their own.