cached-path-relative

Memoize the results of the path.relative function

Latest 1.1.0

NPM

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. With no recent release activity, this is the strongest evidence of stalled maintenance.

Build provenance

No build attestation, trusted publisher, or staged publishing is reported. This reduces publication transparency, although it is not by itself evidence that the release is unsafe.

Maintainers

Only one registry account has publish access. Combined with the repository's user ownership, this leaves a thin visible maintainer base and limited succession capacity.

Project backing

The repository is owned by an individual account rather than an organization. That is consistent with the single-maintainer picture and provides no organizational backup signal.

Release history

The package has only 4 releases across about 10 years, with no releases in the last 12 months and the latest release on January 19, 2022. This materially raises maintenance and abandonment concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2021-23518 cached-path-relative is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 1.1.0.	0.0.0 - 1.1.0	High
CVE-2018-16472 cached-path-relative is vulnerable to Improper Input Validation in versions 0.0.0 - 1.0.2.	0.0.0 - 1.0.2	High