bear/qiq-module

This release appears generally healthy and reasonable to depend on: it has a stable 2.1.2 release, a four-year history with four releases in the last 12 months, active recent commits, current repository activity, tests and changelog coverage in the repository, and organization backing. The main concerns are that all 21 recent commits came from one contributor, the repository does not explicitly mention the package in its README, install and update lifecycle scripts require review, and repository security hygiene is incomplete because no security policy or top-level workflow permissions are declared. These issues warrant due diligence but do not indicate abandonment or make the package unfit on the available evidence.

Latest 2.1.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package defines post-install-cmd and post-update-cmd scripts, which expand install-time execution and merit review before adoption.

Repo bus factor

One contributor made 100% of the 21 commits in the last 3 months, creating a real continuity and bus-factor concern. Organization ownership provides some potential handoff capacity but does not remove the observed concentration.

Repo package mention

The repository name does not exactly match the package name and its README does not mention the package, creating uncertainty about the linkage. The repository URL is nevertheless specifically named BEAR.QiqModule, so this is a caution rather than a severe concern.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policy

The repository has no documented security policy, reducing transparency around vulnerability reporting and response.