whatwg-fetch

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, so consumers cannot independently verify how this release was built. This is a transparency gap, though not evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or packaging. This adds execution complexity, but the provided signal does not indicate that the script is unsafe or unusually broad.

Release historycaution

The package has 51 releases over roughly 11 years, but none in the last 12 months and its latest release was December 13, 2023. This long pause is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the package is mature, the lack of recent activity increases the risk that issues will remain unaddressed.