dotenv-flow

Release historycaution

The package has 27 releases over more than eight years, but no registry release in the last 12 months and its latest release was in December 2023. This indicates slowed maintenance and warrants caution.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Although the repository was pushed more recently, the current commit silence weakens evidence of active maintenance.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap for a package intended to load application configuration.

Workflow auditcaution

All six analyzed action references are unpinned, which weakens build reproducibility. The cache-poisoning findings are low confidence and therefore add little weight; no untrusted checkout or script-injection path was found.