Package Health/achyutn/filament-storage-monitor

achyutn/filament-storage-monitor

This release appears generally suitable to depend on: it is a stable, non-deprecated v1 release with six releases in 148 days, recent repository activity, three active contributors, repository-backed tests, and a verified package/repository name match. The main concerns are the very recent project history, strong commit concentration in one contributor, absent security policy, and a pull_request_target workflow with an untrusted checkout; these warrant review before adoption but do not by themselves indicate abandonment or maliciousness. The MIT declaration, lack of install-time scripts, moderate dependency footprint, and read-only workflow permissions are positive factors.

Latest v1.4.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

The sole workflow uses pull_request_target together with an untrusted checkout, creating a meaningful CI security risk even though no script injection was detected.

Maintainers

Only one account has registry publish access. This is a limitation in publishing continuity, although the repository shows three active contributors and the owner is an identifiable user account.

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational handoff capacity to offset the concentrated contributor base.

Release history

Six releases over 148 days, with a median release interval of about 1.3 days, show active early development. The short project age means long-term maintenance is not yet established.

Repo bus factor

Although three contributors were active, the top contributor made 31 of 33 commits, or about 94%, leaving maintenance substantially concentrated in one person.