Package Health/altapay/magento2-community

altapay/magento2-community

This is a healthy, actively maintained release with a long release history, frequent recent releases, stable versioning, an active non-archived organization-backed repository, documented tests and changelog, a clear MIT license, and a small runtime dependency surface. The main concerns are that all recent repository commits came from one contributor, repository popularity is low, no security policy is present, and workflow permissions and one script-injection finding warrant review; these reduce resilience and transparency but do not outweigh the strong release and project activity evidence.

Latest 4.2.5

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

Four workflows were analyzed with no pull_request_target or untrusted checkout findings, but one deployment workflow contains a script-injection pattern; deployment workflow inputs should be reviewed before relying on the repository.

Repo bus factor

One contributor made 100% of the 9 commits in the last 3 months, creating a low short-term bus factor. Organization ownership provides some handoff capacity, so this is caution rather than a severe abandonment finding.

Repo commit activity

There were 9 commits in the last 3 months, demonstrating recent work, but all were produced by one active maintainer; the activity is healthy while the concentration remains a resilience concern.

Repo popularity

The repository has only 2 stars, 6 forks, and 7 watchers, which indicates limited external adoption evidence; popularity is supporting evidence rather than a health verdict, and the active release and repository signals compensate for this gap.

Security policy

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency. This is a hygiene concern rather than evidence that the package is unsafe.