alizharb/hookx

Tests, a changelog, documentation, matching source, and clear MIT licensing make the project easy to inspect and integrate. Its workflow uses unpinned actions and the repository reports no security-scanning tools, adding maintenance and build-integrity concerns.

Latest v1.1.0

Packagist

60%

Total Score

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is about 10 months old but has only two releases, both clustered within three days, and no later release activity is shown. This leaves maintenance continuity unproven for a library intended for ongoing use.

Repo popularity

The repository has zero stars, forks, and watchers. Popularity is supporting evidence rather than a verdict, but these counts provide no external adoption signal to offset the limited maintenance history.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing scanning is a modest repository hygiene gap rather than evidence that the release is unsafe.

Repository archived

The linked repository is not archived, but its last push was about 10 months ago, reinforcing the concern raised by the short release history.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, both analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.