@zkochan/which

Like which(1) unix command. Find the first instance of an executable in the PATH.

Latest 2.0.3

NPM

52%

Total Score

caution

Usable with caveats: no release in nearly five years and a lookalike identity increase adoption risk.

Health Score Breakdown

Release history

The package has only two releases, both published about five years ago, with no releases in the last 12 months. This materially raises abandonment and compatibility risk.

Lifecycle scripts

A prepublish lifecycle script adds some install or publication complexity, though this is not by itself evidence of unsafe behavior.

Name lookalike

@zkochan/which resembles the much more established which package, has moderate artifact overlap, and identifies that package in its README. The lack of explicit fork disclosure increases confusion for consumers, although the overlap is not near-total.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, which weakens evidence of current maintenance capacity.

Workflow audit

All eight workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene risk, although no untrusted checkout or script-injection sink was reported.