andrewdwallo/transmatic

The package has clear documentation, tests in its repository, an MIT license, and a security policy. Its single-maintainer project has gone without a registry release for about 19 months, while workflow permissions and action pinning need attention.

Latest v1.2.0

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs a post-autoload-dump install-time script, adding some installation complexity and execution surface even though no harmful behavior is shown here.

Project backing

The package and repository are owned by the same individual account, providing direct ownership alignment but no organization-backed maintainer redundancy.

Release history

The package has 10 releases over about 35 months, but no release in the last 12 months and its latest release was about 19 months ago, which raises maintenance concerns.

Repo commit activity

The repository shows zero commits and zero active maintainers in the measured three-month window, weakening evidence of current maintenance capacity.

Workflow audit

All 10 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is a workflow-hygiene caution rather than a severe standalone risk.