proxy-from-env

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving the relationship between source and published artifact less transparent.

Maintainerscaution

Only one registry account has publish access. That is a real continuity risk, although the recent release history shows the package is still being maintained.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release and push offset this somewhat, but the short-term development activity is thin.

Repo toolingcaution

No build tooling or security scanning tools were detected. This is a modest transparency and assurance gap for a small package, not evidence that the package is unusable.

Security policycaution

The repository has no security policy, so users have no documented vulnerability-reporting path.