env-paths

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has less visible institutional backing. The recent release and matching repository evidence provide some compensation.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, a modest maintenance concern. This is partly offset by the recent 4.0.0 release and repository push.

Repo toolingcaution

No build tool or security scanning tool is reported. For this small package the lack of a build system is unsurprising, but the absence of security scanning is a minor hygiene gap.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, and it avoids broad top-level write permissions. However, both action references are unpinned, reducing reproducibility and supply-chain protection.