set-immediate-shim

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, leaving publication origin less transparent; this is a moderate transparency gap rather than evidence of unsafe behavior.

Maintainerscaution

One registry publisher account is present, which is a narrow publishing base, but this is consistent with the linked individual-owned project and is supported by matching repository evidence.

Release historycaution

This is a long-lived package released over about 11 years, with six releases; however, it had no releases in the 12 months before the latest 2025-09-13 release, indicating a slow cadence for a small utility.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the three months measured after the latest release. For a small stable shim this may reflect completion, but it reduces evidence of ongoing maintenance.

Repo toolingcaution

No build tool or security scanning tool was detected. The package is a small, direct JavaScript shim, so the missing build tooling is less significant, though the lack of scanning modestly reduces transparency.