Package Health/creativehabib/media-manager

creativehabib/media-manager

This is a usable, actively released package with a stable v1.2.0 release, MIT licensing, clear documentation, tests and a changelog in both the artifact and repository, no deprecation, no install-time lifecycle scripts, and a non-archived source repository. However, the repository shows zero commits and zero active maintainers in the last 3 months despite 20 releases in the last 12 months, suggesting release activity may not reflect sustained development. The project also has very limited adoption evidence, no security policy or security-scanning tooling, and is backed by a single individual account. It is reasonable for adoption with normal dependency review and maintenance contingency planning, but should not be treated as a highly mature or strongly supported dependency.

Latest v1.2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository has 0 commits and 0 active maintainers in the last 3 months. This is a meaningful maintenance and abandonment concern, particularly because the frequent release history does not compensate for absent underlying commit activity.

Project backing

The repository is owned by a single user account rather than an organization, indicating limited formal project backing and potentially limited continuity if the maintainer becomes unavailable.

Repo issue activity

There are no open issues and two open pull requests, with one pull request merged in the last month. This shows some recent interaction, but no new or closed issues and outstanding pull requests provide only limited evidence of sustained maintenance.

Repo popularity

The repository has only 1 star, 1 fork, and 0 watchers. Popularity is supporting evidence rather than a verdict, but these low figures provide little external validation or community support.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured. The missing security automation lowers transparency and assurance, though it is not by itself evidence that the package is unsafe.