chrismademe/twilight

Tests, release notes, and a stable MIT declaration provide a useful baseline. The lone maintainer and missing security policy leave less operational assurance, while workflow dependencies are unpinned.

Latest 1.4.7

Packagist

57%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 54 releases since May 2024, but none in the last 12 months and the latest release was about 20 months ago. This materially increases maintenance and abandonment concern despite the historically active release count.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, indicating that development has currently stopped. The recent release history does not compensate for this prolonged inactivity.

Maintainers

Only one registry maintainer is listed, which leaves limited visible publishing capacity for a user-owned project. This is a supporting concern rather than a severe risk on its own.

Security policy

The repository has no security policy, so there is no documented channel or process for reporting and handling vulnerabilities. This lowers transparency but does not by itself make the release unfit.

Workflow audit

All 3 analyzed action references are unpinned, leaving workflow dependencies exposed to upstream changes, although the workflow uses read-only permissions, has no untrusted checkout or injection findings, and the audit completed fully. The result is a hygiene caution rather than a severe workflow risk.