carbon/image

carbon/image 4.8.0 appears generally safe to depend on from a supply-chain health perspective: it has been maintained since 2017, has 48 releases, a current stable release, recent publication and repository activity, an unarchived organization-owned repository, clear licensing, and no install-time scripts or dangerous workflows. The main concerns are modest maintenance depth and transparency: only one commit from one contributor in the last 3 months, low repository popularity, no repository security policy or security scanning, and no tests or changelog in either the artifact or repository. These concerns warrant monitoring but do not outweigh the package's long release history, recent update, project backing, and complete package structure.

Latest 4.8.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The package has a substantial README and the repository uses GitHub Releases, which partly compensates for the absence of packaged and repository tests and a changelog. Tests and changelog coverage remain limited, but this is a hygiene concern rather than a severe dependency risk.

Repo bus factor

All recent commit activity is concentrated in one contributor, creating a low short-term bus factor. Organization ownership provides some capacity for handoff, so this is caution rather than a severe risk.

Repo commit activity

The repository received 1 commit in the last 3 months from 1 active maintainer, demonstrating recent activity but a low maintenance tempo. This is a meaningful slowing-maintenance concern, partially offset by the current release and long release history.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. This avoids an unresolved backlog, but also provides little evidence of an active user or maintainer community.

Repo popularity

The repository has only 3 stars, 0 forks, and 2 watchers. This is weak supporting evidence for community adoption, but popularity is not decisive and does not by itself indicate abandonment.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Jon Uhlmann

Direct Dependencies

Dependency	Last Release	Score
neos/neos Version ^8.3	—	—
carbon/eel Version ^2.0 \|\| dev-master	—	—
carbon/notification Version ^2.1	—	—
sitegeist/kaleidoscope Version ^6.7 \|\| ^7.0	—	—