@walletconnect/environment

Name lookalikedanger

The package resembles “environment,” which has far more downloads, and the README identifies the package with that lookalike name. Although artifact overlap is zero, the identity signal makes consumer confusion a serious concern.

Release historycaution

Only three releases exist, with none in the last 12 months; the latest release was in November 2022, more than three years ago. This materially raises abandonment and compatibility risk.

Repo commit activitycaution

The repository has recorded zero commits and zero active maintainers in the last three months. A recent repository push exists, but it does not compensate for the absent observed development activity.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, so the package-to-source relationship is less transparent. The organization backing provides some context but does not remove this gap.

Workflow auditcaution

The audit reports high-confidence template-injection findings in publishing workflows and seven unpinned action references out of eight; no untrusted checkout or script-injection sink was found. Trusted publishing is also flagged, which warrants caution for release integrity.