node-fetch-native

Build provenancecaution

This release has no build attestation or trusted-publisher provenance, leaving publication origin and build integrity less independently verifiable. The linked organization-backed repository provides some compensating transparency.

Release historycaution

The package has 32 releases over roughly four years, but none in the last 12 months; its latest release was over a year ago. The historical cadence supports maturity, while the recent pause lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is meaningful abandonment risk despite the repository not being archived.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response expectations. This is a governance gap rather than evidence of unsafe code.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, which is a minor reproducibility and supply-chain hygiene gap.