Package Health/launchdarkly/server-sdk-consul

launchdarkly/server-sdk-consul

Documentation, tests, licensing, and organization backing make the package easier to evaluate. Those strengths do not fully offset the concerns above.

Latest 3.2.0

Packagist

48%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package borrows the identity of the much more established launchdarkly/server-sdk and is marked as doing so, despite only 9% artifact overlap and README evidence that it is a Consul integration. This creates a material risk that consumers could select it when they intended the main SDK.

Release history

The package has had five releases since August 2021, but none in the last 12 months and the latest release was October 25, 2023. That weakens confidence in ongoing maintenance for a dependency.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months. The repository was pushed recently, but the observed activity still provides little evidence of active development.

Workflow audit

All three detected findings are high-confidence unpinned container images, and five of six action references are unpinned. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe release-path risk.