captainhook/secrets

A clear MIT license, focused dependencies, and a matching repository make the package easy to audit. Install-time scripting, missing security policy, and unpinned workflow actions add maintenance and build-hygiene concerns.

Latest 0.9.7

Packagist

61%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

A post-install command runs during installation, adding execution during dependency setup and increasing maintenance and supply-chain exposure compared with a package without install hooks.

Release history

The package has had no registry release in the last 12 months, and its latest release was about 17 months ago. This weakens confidence in ongoing maintenance, although the seven-release history shows it is not newly abandoned.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last three months. With no recent release activity either, this is meaningful evidence of a currently inactive project.

Security policy

The repository has no security policy. This does not indicate a vulnerability, but it provides less transparency about how security reports are handled.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers or audit findings, but both referenced actions are unpinned. That leaves the build exposed to moving action contents despite otherwise clean workflow checks.