cp-file

Registry deprecationdanger

The registry marks the entire package as deprecated with the message “Renamed to copy-file.” This withdraws the package as a dependency choice even though its source repository remains available.

Release historycaution

The package has 30 releases over more than 12 years, but no registry release in the last 12 months; the latest release is 11.0.0 from November 2023. The repository has since received a commit, which shows some ongoing source activity but does not restore the package’s registry status.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance base. The repository is user-owned rather than organization-backed, so there is no provided project-backing signal to compensate for that concentration.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkout or script-injection paths, and no write-wide top-level permissions. Both action references are unpinned, which is a modest reproducibility and supply-chain hygiene gap.