launchdarkly/server-sdk-dynamodb

Name lookalikedanger

The package borrows the identity of the much more established launchdarkly/server-sdk, with 4 releases versus 86 and about 9,062 versus 425,382 monthly downloads. Its low artifact overlap and README identification suggest an integration rather than a direct copy, but the naming still creates a meaningful dependency-selection risk.

Release historycaution

The package has only 4 releases and none in the last 12 months; the latest release was on July 31, 2024, more than two years ago. This materially increases the risk of stale maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. This conflicts with the recent push timestamp and still leaves current development activity unconfirmed, so it lowers confidence in ongoing maintenance.

Workflow auditcaution

All 5 workflows were analyzed successfully, with no untrusted checkout or script-injection findings. However, 3 high-confidence findings identify unpinned container images, and 5 of 6 action references are unpinned; this is a real reproducibility and build-supply-chain hygiene gap.