node-fetch-commonjs

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old last push, this is the strongest evidence that maintenance has stopped.

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this artifact was produced. This is a transparency gap, though not severe by itself.

Package scaffoldingcaution

The published artifact includes a README, and the repository has a changelog documenting project history. Missing tests in the published artifact are normal packaging practice, while the repository's lack of tests limits maintenance assurance.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no visible organizational backing to offset the package's single-maintainer risk.

Release historycaution

The package has 9 releases over about five years, but none in the last 12 months and its latest release was in September 2023. This indicates a stable but inactive project, which raises maintenance risk.