loose-envify

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old release, this is the strongest evidence of potentially abandoned maintenance.

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is present. This weakens release transparency, although it is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access. That is a thin operational base and creates some continuity risk, though the linked repository is clearly owned by the same individual.

Project backingcaution

The repository is owned by an individual rather than an organization, providing limited visible institutional backing. That makes the single-maintainer and inactivity concerns more consequential.

Release historycaution

The package has six releases since 2015, but its latest release was about eight years ago and there have been no releases in the last 12 months. That long release gap is a meaningful maintenance concern, although the package may be mature and stable.