Package Health/alexskrypnyk/shell-variables-extractor

alexskrypnyk/shell-variables-extractor

This release has strong evidence of active development and reasonable publication hygiene: it was released recently, has 8 releases in the last 12 months, uses a stable version, has a license, a substantial README, repository tests, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist in favor of alexskrypnyk/shellvar, which is a major adoption risk despite the linked repository remaining active. Maintenance is also concentrated in one contributor, the repository has no security policy, and workflow permissions are broader than ideal; the repository does not clearly identify or mention the published package name. This makes the release usable but a liability for a new dependency unless the replacement package is evaluated instead.

Latest 1.7.1

Packagist

45%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names alexskrypnyk/shellvar as its replacement. This is a severe dependency-selection risk even though other signals show recent activity.

Dangerous workflows

One of five workflows uses pull_request_target, which warrants review because it runs with elevated event semantics. No untrusted checkout or script-injection patterns were detected, partially reducing the concern.

Repo bus factor

One contributor made 100% of the three commits in the last 3 months. With a user-owned project rather than organization backing, this creates meaningful abandonment and handoff risk.

Repo commit activity

There were 3 commits in the last 3 months, all from one active maintainer. Recent activity exists, but the low volume and concentration limit maintenance resilience.

Repo package mention

The repository name does not match the published package name and its README does not mention the package. This weakens provenance clarity and raises concern that the registry package may not be clearly tied to the linked repository.