eslint-plugin-lodash

Healthy and suitable to install, with a long release history, current maintenance, clear licensing, and a well-documented package. The project has low popularity and lacks explicit security and workflow permission hardening, so review its maintenance before relying on it long term.

Latest 8.1.0

NPM

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is available. This reduces publication transparency, but it is a caution rather than a health verdict because the package has a long release history and a matching active repository.

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational backing shown. This is not inherently unhealthy, but it means continuity depends more heavily on the demonstrated maintainer activity.

Repo popularity

The repository has zero stars and one fork, indicating very limited visible adoption. Popularity is supporting evidence rather than a verdict, so this lowers confidence in broad community scrutiny but does not outweigh the package's history and current source activity.

Repo tooling

The repository reports no build tooling or security-scanning tools. The absence of security scanning is a transparency and maintenance gap, though the package is a relatively small JavaScript plugin with simple repository structure.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a modest transparency gap for a package consumed in developer tooling.