async-aws/code-deploy

This is a healthy, established release suitable for dependency use. It has a six-year history, 20 releases including four in the last 12 months, a stable non-prerelease version, no registry deprecation, an active unarchived organization-backed repository, and recent commits from three maintainers. The package is clearly licensed, has a changelog, matching repository, build configuration, and repository tests, while its small runtime dependency set limits maintenance exposure. The main concerns are absent repository security scanning and security policy, plus workflows that do not declare top-level token permissions; these are transparency and CI-hardening gaps rather than evidence of abandonment. Repository popularity is very low, but recent release and commit activity provide stronger evidence of ongoing maintenance.

Latest 2.5.0

Packagist

86%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo issue activity

No new or closed issues or pull requests were recorded in the last month, and issue totals are unavailable. This limits visibility into community activity, but does not establish abandonment because recent commits and releases are present.

Repo popularity

The repository has only 1 star and 0 forks, indicating limited public adoption, but this is supporting evidence and is outweighed by the package's release and commit activity.

Repo tooling

The project uses Make and Composer build tooling, but no security scanning tools were detected. The build setup is positive, while the missing scanning is a security-process gap.

Security policy

The repository has no security policy file, reducing transparency about vulnerability reporting and response procedures.

Token permissions

Both workflows lack top-level token permission declarations. No workflow declares top-level write access, but explicit least-privilege configuration is still absent.