dotenv-defaults

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is present. This lowers release transparency, though it is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access, leaving a thin publishing base. The linked repository is user-owned rather than organization-backed, so no provided signal compensates for this concentration.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. The recent release and push show some activity, but they do not offset the thin current maintenance trail fully.

Repo toolingcaution

No build tool or security-scanning tool was detected. The package does have tests, but the absence of repository security tooling is a modest maintenance and assurance gap.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although it does not establish abandonment or an immediate dependency failure.