promise.allsettled

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than an attested release.

Dependency profilecaution

Six runtime dependencies make this small shim less self-contained and increase transitive maintenance exposure, though the dependency list is explicit rather than absent or opaque.

Lifecycle scriptscaution

The package uses prepack and prepublish lifecycle scripts. These are relevant install or publication behavior, but the signal does not show an unsafe command or a runtime installation action.

Release historycaution

The package has had no release in about three years, with zero releases in the last 12 months. Its nine-release history shows maturity, but the long release gap raises abandonment and currency concerns.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. The recent repository push offsets this somewhat, but the measured development activity is still thin.