async-aws/simple-s3

This is a healthy, actively maintained release with a six-year history, four releases in the last 12 months, a stable major version, current repository activity, and three active contributors with no strong bus-factor concentration. The package is clearly backed by a matching organization-owned repository, includes a license, changelog, build configuration, and source tests, and has no install-time scripts or dangerous workflow patterns. The main cautions are the absence of repository security scanning and a security policy, plus workflows that do not declare top-level token permissions; these are transparency and CI-hardening gaps rather than evidence of abandonment. It appears reasonable to depend on, subject to normal review of its small runtime dependency set.

Latest 3.1.0Packagist

Health Score Breakdown

Repo toolingcaution

Composer is used as a build tool, but no security-scanning tools are detected. The missing scanning is a genuine CI hygiene gap, though it does not by itself indicate abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented; this is a transparency gap for a package handling cloud-service integration.

Token permissionscaution

Both workflows lack top-level token-permission declarations. Although neither grants top-level write access, explicit least-privilege permissions would improve CI hardening.

View all 19 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Direct Dependencies

Dependency	Last Release	Score
async-aws/s3 Version ^3.0	—	—