kero/typesafe-env

Project backingcaution

The package and repository are backed by the same individual account rather than an organization, so the single registry maintainer reflects a genuinely thin ownership base. This is consistent with the small project's scope but limits continuity if that maintainer stops contributing.

Release historycaution

The package has had no registry release in about 17 months, and no releases in the last 12 months, which lowers confidence in ongoing maintenance. Its seven releases since October 2023 show that it is not entirely abandoned.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which is a meaningful sign of currently limited maintenance activity. The recent repository push and release history provide some counterweight but do not show active recent development.

Security policycaution

No security policy is present in the repository, leaving the process for reporting vulnerabilities unclear. The package's small scope and Dependabot reduce, but do not remove, this transparency gap.

Workflow auditcaution

Both workflows use read-only permissions and the audit found no untrusted checkouts, script injection, or other findings, which is reassuring. However, all 8 analyzed action references are unpinned, leaving avoidable action-supply-chain exposure.