node-ensure

Release historydanger

This package has only one release, published about 11 years ago, with no releases in the last 12 months. That is strong evidence of abandonment risk for a dependency.

Repo commit activitydanger

The repository has zero commits and zero active maintainers in the last three months, consistent with a project that is no longer actively maintained.

Build provenancecaution

No build attestation or staged publishing is available, reducing publication transparency. The package is a tiny five-file artifact, so this is a secondary concern rather than the main risk.

Maintainerscaution

One registry maintainer is a thin publishing base. The matching user-owned repository provides identity continuity, but not evidence of ongoing maintenance capacity.

Repo toolingcaution

The repository has no build tooling or security-scanning tooling. This is a modest transparency and maintenance gap, though the package is very small and has no install scripts.