npm-run-path

Maintainerscaution

Only one registry publishing account is listed, creating a limited publisher base; this is consistent with the repository being owned by an individual, but it still increases continuity risk.

Release historycaution

The package has existed since 2015 with 14 releases, but it has had no release in about two years and none in the last 12 months, which lowers confidence in current maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, indicating currently inactive development and some abandonment risk.

Repo toolingcaution

The repository reports no build tools or security-scanning tools. This is a transparency and maintenance gap, though the small package is published as a compact source artifact.

Token permissionscaution

The only workflow has no top-level token permissions declaration. No write permissions are requested, but the absence of an explicit restriction leaves workflow access less transparent.