object-assign

Project backingcaution

The source repository is owned by an individual account rather than an organization. This does not indicate a problem by itself, but it provides less explicit organizational backing for a project with no recent commits.

Release historycaution

The package has 19 releases since February 2014, but the latest release was in January 2017 and there were no releases in the last 12 months. That long release gap lowers confidence in ongoing maintenance, even for a stable utility.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent repository push provides limited compensation, but current development activity is still absent.

Workflow auditcaution

The single workflow was fully analyzed with no high- or medium-severity findings and no dangerous triggers or sinks. However, both action references are unpinned, leaving a modest reproducibility and supply-chain hygiene gap.