object.values

It has clear MIT licensing, tests, documentation, and a matching organization-backed repository. Its workflows leave all five action references unpinned, weakening build reproducibility.

Latest 1.2.1

NPM

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but it is moderated by the package's coherent artifact and matching repository.

Release history

The package is mature, with 15 releases since 2015, but it had no releases in the last 12 months and its latest release was about 21 months before collection. For a stable compatibility shim this is a meaningful maintenance concern, though not evidence of abandonment by itself.

Repo commit activity

The repository had no commits and no active maintainers in the last 3 months, indicating currently quiet development. The repository was pushed more recently than the package release, which partly offsets but does not remove the concern.

Workflow audit

All five workflows were analyzed successfully with no audit findings, no untrusted checkouts, and no script-injection detections. However, all five action references are unpinned, so workflow dependencies can change unexpectedly and reproducibility is weaker.