until-async

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less independently verifiable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer represents a thin but coherent ownership base.

Release historycaution

This is a young package with one registry release, published about one year ago, so its long-term maintenance record is limited.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance and abandonment concern for a package with only one release.

Repo toolingcaution

The project uses TypeScript, Vitest, and a build tool, but no security-scanning tooling was detected; the tests and structured build still provide useful compensating evidence.