blueways/bw-jsoneditor

Usable with caveats: it has a long release history, clear licensing, documentation, tests, and a current stable release. Recent repository activity is absent, and the small owner base plus limited security controls increase maintenance risk.

Latest 2.1.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

Five workflows were analyzed with no untrusted checkout or script-injection findings, but one uses pull_request_target, which warrants care because that workflow class can expose privileged automation to pull requests.

Lifecycle scripts

A post-autoload-dump install-time script is present, creating some execution-time supply-chain exposure, though a single declared script is not by itself evidence of unsafe behavior.

Maintainers

Only one registry account has publish access, which limits publishing redundancy. This concern is partly offset by the repository's documented tests, releases, and long publication history.

Project backing

The package is published under the blueways namespace, but the linked repository is owned by an individual account rather than an organization. This gives the project a relatively narrow visible backing structure.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, which is a meaningful sign of currently limited maintenance activity despite the recent release.