codeurx/dotenv

The package is clearly identified, MIT-licensed, and has a minimal dependency surface with no install-time scripts. Its repository lacks a security policy and security scanning, adding transparency concerns. The small, focused file tree partly limits the impact of those gaps.

Latest v1.1

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published more than eight years ago, with no releases in the last 12 months and only two releases overall. This is strong evidence of abandonment risk, although the package is not deprecated.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old last push, this materially raises abandonment risk.

Maintainers

Only one account has registry publishing access, which limits publishing redundancy. The repository is user-owned, so the short registry maintainer list is a meaningful but modest resilience concern.

Repo popularity

The repository has zero stars and forks and only one watcher. Popularity is supporting evidence rather than a verdict, but these figures provide no external sign of active community support.

Repo tooling

Composer is used for builds, but no security scanning tool is configured. For a small package this is a modest hygiene gap, not evidence that the release is unsafe.