node-fetch-h2

Name lookalikedanger

The artifact overlap with node-fetch is 1.0, the README identifies the package as node-fetch, and node-fetch has 73 stable releases versus 1 here; this strongly indicates consumers may have wanted the established package instead.

Release historydanger

The package has only 2 releases, with the latest published nearly eight years ago and no releases in the last 12 months, indicating severe abandonment risk.

Repo commit activitydanger

There were 0 commits and 0 active maintainers in the last 3 months, consistent with the long release gap and indicating the project is inactive.

Repo package mentiondanger

The repository name matches the package, but its README does not mention node-fetch-h2 and instead presents node-fetch content, reinforcing the lookalike and identity concern.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers cannot verify how this release was produced.