p-memoize

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a supply-chain transparency gap, not evidence that the release is unsafe.

Release historycaution

The package has existed since 2016 with 21 releases and a median interval of about 65 days, but it had no releases in the last 12 months. Its long history is reassuring, while the recent pause modestly lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That suggests maintenance has slowed, although the recent push and long release history partly offset the concern.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, showing a defined build process, but no security-scanning tool was detected. The established build is positive while the missing scanner is a minor hygiene gap.

Workflow auditcaution

The only workflow was fully analyzed with no high- or medium-confidence findings, no untrusted checkouts, and no script injection. However, both referenced actions are unpinned, which is a modest reproducibility and supply-chain hygiene concern.