Package Health/conductor/git-vcs-support

conductor/git-vcs-support

Healthy and suitable to use, with a narrow maintenance risk. It has frequent recent releases, a stable version, tests, documentation, and organization backing, but recent repository work is concentrated in one contributor and the repository does not clearly mention this package in its README.

Latest 4.2.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publishing access, which is a concentration risk, but the organization-backed repository and active release history provide compensating evidence that this is not by itself a severe concern.

Repo bus factor

All 4 recent commits came from one contributor, creating a thin maintainer base. Organization ownership partly offsets handoff risk, but no second active contributor is shown.

Repo package mention

The repository name does not match the package name and its README does not mention the package, so the connection between the published package and its source is less transparent. This is a genuine provenance concern despite the repository having a plausible related name.

Repo popularity

The repository has no stars or forks and only 7 watchers. This limits community validation, though popularity is supporting evidence and the package shows independent release activity.

Repo tooling

Composer is used as a build tool, but no security scanning tools are present. The missing scanning is a transparency gap, though it is not evidence that the package is unsafe.