Package Health/creativestyle/magesuite-email-attachments

creativestyle/magesuite-email-attachments

This is a generally usable and established package: it has been published for nearly 8 years, has 23 releases including 3 in the last 12 months, is on a stable non-prerelease major version, is not deprecated, and is backed by an organization-owned repository. The artifact is licensed, includes tests and a changelog, has no install-time lifecycle scripts, and declares only one runtime dependency. However, current maintenance evidence is mixed: the repository shows no commits or active maintainers in the last 3 months, has minimal community engagement, lacks a security policy and security-scanning tooling, and does not clearly identify or mention this package despite the linked repository being named for it. The package is reasonable to adopt with normal dependency monitoring, but it does not provide strong evidence of an active, transparent maintenance process.

Latest v4.1.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This conflicts with the recent package release and raises a meaningful concern about ongoing maintenance capacity.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. This is not inherently unhealthy, but it provides no evidence of active community maintenance.

Repo package mention

The repository name does not match the full package name and its README does not mention the package. Although the repository is organization-backed and similarly named, the lack of an explicit package reference weakens provenance transparency.

Repo popularity

The repository has 0 stars, 1 fork, and 3 watchers. This is weak supporting evidence of community adoption, though popularity alone is not decisive for a small package.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured. The missing scanning coverage is a transparency and assurance gap, not evidence of maliciousness.