Package Health/@amplitude/experiment-core

@amplitude/experiment-core

This release appears healthy and suitable to depend on: it has a strong release cadence, current repository activity, seven active contributors with no excessive concentration, organization backing, build provenance, a license, type declarations, tests and changelog coverage in the repository, and a low runtime dependency count. The main concerns are that the linked repository does not match the package name or mention the package in its README, the repository lacks a security policy, and its workflows do not declare top-level token permissions; these reduce transparency and workflow-hardening confidence but are not sufficient to outweigh the substantial maintenance and provenance evidence.

Latest 0.13.6

NPM

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

100

Health Score Breakdown

Lifecycle scripts

The package has a prepublish lifecycle script; this warrants awareness because installation-related scripts can affect reproducibility, although prepublish is not by itself a severe concern.

Repo package mention

The repository name does not match the package name and its README does not mention the package, creating a transparency concern that the link may not specifically document this package; organization backing and the package scope provide some context but do not remove the gap.

Security policy

No repository security policy was found, leaving vulnerability reporting and security-process transparency unclear.

Token permissions

All 7 workflows lack top-level token permissions declarations, which weakens least-privilege clarity even though none declares top-level write permissions.

Version stability

Version 0.13.6 is not a stable major release, but it is a normal release rather than a prerelease and only 5% of recent releases were prereleases.