Package Health/68publishers/health-check

68publishers/health-check

This is a usable, transparently licensed package with a matching source repository, organization backing, repository tests, stable versioning, and no deprecation or install-time lifecycle scripts. However, maintenance evidence is mixed: the package has existed since 2021 but has only 9 releases, one release in the last 12 months, and no commits or active maintainers in the last 3 months. The small popularity footprint, absent security policy and security scanning, and workflows without explicit top-level token permissions add moderate transparency and maintenance concerns. It is reasonable to depend on with normal review and upgrade monitoring, but it does not currently demonstrate the activity level of a strongly maintained dependency.

Latest v1.1.2

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were zero commits and zero active maintainers during the last 3 months. Combined with the slow release cadence, this is the strongest maintenance concern, although a recent published release and repository push provide limited counterevidence.

Maintainers

Only one registry account has publish access, which is a limited publishing base. The organization-backed repository provides some compensating project context, so this remains a caution rather than a severe risk.

Release history

The package is mature at 1,855 days old, but has only 9 releases and one release in the last 12 months, indicating a relatively slow release cadence. The recent release provides some evidence of continued publishing, so this is a caution rather than a severe abandonment finding.

Repo popularity

The repository has 3 stars, 0 forks, and 1 watcher. This is limited supporting evidence of community adoption, but popularity alone is not decisive for package health.

Repo tooling

The repository uses Make and Composer, but no security scanning tools were detected. Build tooling is present, while security-process coverage is incomplete.