env-editor

Build provenancecaution

No build provenance attestation or trusted-publisher metadata was found. This limits publication transparency, though it is not by itself evidence that the release is unsafe.

Release historycaution

The package has existed for over 9 years with 13 releases, but it had no releases in the last 12 months after version 1.3.0. This indicates a quiet release cadence rather than clear abandonment.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, a meaningful maintenance warning. The recent repository push provides some compensating evidence but does not show sustained development activity.

Repo toolingcaution

The repository uses no build tool and has no detected security scanning, leaving process coverage limited. For this small package, that is a hygiene gap rather than a severe adoption blocker.

Workflow auditcaution

The workflow audit analyzed all workflows with no findings, dangerous triggers, or untrusted checkouts. Both action references are unpinned, which is a modest reproducibility and supply-chain hygiene concern.