b13/aim

b13/aim 0.5.0 appears usable and actively maintained, with six releases over 148 days, a repository pushed on the assessment date, 28 commits from four active maintainers in the last three months, and recent issue and pull-request resolution. The package is well documented and scaffolded with tests and a changelog, has an explicit GPL-2.0-or-later license, no install-time lifecycle scripts, and is backed by an organization-owned repository that matches the package. The main concerns are that the README explicitly identifies the API as alpha and potentially unstable before 1.0, commit activity is concentrated in one contributor, and the repository lacks a security policy, security-scanning tools, and top-level workflow permission declarations. These are meaningful transparency and operational-hygiene gaps, but there is no evidence of deprecation, archival, abandoned development, or repository/package mismatch.

Latest 0.5.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a publishing continuity concern, although the repository's organization backing and observed contributor activity provide some compensation.

Repo bus factor

The top contributor made 23 of 28 commits, or about 82%, which concentrates maintenance risk; four active contributors and organization ownership partly compensate but do not remove the concern.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected, leaving a security-process gap for a package that handles provider credentials and AI requests.

Security policy

The repository has no security policy, reducing the transparency of vulnerability reporting and response expectations.

Token permissions

Neither workflow declares top-level token permissions. Although no workflow has top-level write permissions, the absence of explicit least-privilege declarations is a workflow-hygiene concern.