string-env-interpolation

Build provenancecaution

No build provenance attestation or trusted-publisher metadata is present, limiting publication transparency, although this is a moderate hygiene gap rather than evidence of unsafe behavior.

Release historycaution

The package has had only two releases, both in June 2020, with no releases in more than six years. That materially raises abandonment risk for a dependency expected to receive fixes or updates.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Together with the old release history, this points to a thin maintenance outlook.

Repo issue activitycaution

There are two open issues and no issues or pull requests were opened or closed in the last month, indicating little current project activity.

Repo toolingcaution

The repository uses TypeScript and npm scripts for builds, but no security-scanning tools are reported. This is a modest transparency and maintenance gap for a small package.