node-pre-gyp

Registry deprecationdanger

The entire package is deprecated, and the registry directs users to @mapbox/node-pre-gyp because this package will no longer receive updates. This is a major adoption and abandonment concern.

Release historydanger

The package has 110 releases and historically shipped about every 10 days, but its latest release was in December 2020 with no releases in the last 12 months. The long release gap materially raises staleness risk.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving consumers without independently verifiable evidence of how the artifact was produced.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, despite some recent issue and pull-request activity. That indicates limited current maintenance capacity.

Workflow auditcaution

All 13 analyzed action references are unpinned, and the release workflow uses long-lived registry-token publishing; the audit found no high- or medium-severity issues, but these remain meaningful workflow hygiene concerns.