capell-app/theme-agency

The project is organized and actively publishing, with clear documentation and an organization behind it. Its single-contributor history and risky workflow permissions make long-term maintenance and release safety less reassuring.

Latest v1.0.40

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Workflow audit

The only workflow combines a pull_request_target trigger and an untrusted checkout with top-level write permissions; all 2 action references are also unpinned. Although no injection finding was reported, untrusted code can reach a broadly permitted token, making this a serious release-workflow risk.

Release history

The package is only 6 days old, despite 39 releases, so it has little demonstrated longevity. The rapid release cadence shows active publishing but does not yet establish maturity.

Repo bus factor

One contributor made all recent commits, creating a concentrated bus factor. Organization backing partly offsets handoff risk but no second active contributor is evidenced.

Repo commit activity

Only 3 commits from 1 active maintainer were recorded in the last 3 months. The organization owner provides some continuity, but no broader recent contributor activity is shown.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest assurance gap rather than evidence of unsafe code.