dotenv-webpack

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release was produced; the otherwise transparent repository provides only partial compensation.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release shows the project is not abandoned outright, but this still raises a current maintenance concern.

Security policycaution

The repository has no security policy, which leaves vulnerability-reporting expectations less transparent for a package that handles environment configuration.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all 10 action references are unpinned, weakening build reproducibility and supply-chain hygiene.