danog/php-rtc-srtp

Clear licensing, tests, security scanning, and a security policy support adoption. The package omits a README and uses four unpinned workflow actions, leaving some provenance and consumer-documentation gaps.

Latest 1.1.14

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

post-install-cmd and post-update-cmd scripts run during dependency operations, which adds supply-chain exposure compared with a package without install-time behavior. No provided signal shows those scripts are unsafe, so this is a limited caution rather than a severe finding.

Project backing

The package and repository are owned by the same named individual rather than an organization. This is coherent ownership, but it provides less institutional handoff capacity than organization backing.

Release history

The package is young at 58 days and has shipped 23 releases, with a median interval of about 3 hours. That rapid cadence warrants some maturity caution, although the consistent release activity is also evidence that the project is being maintained.

Repo bus factor

Two contributors were active, and the second contributor made 32.5% of recent commits, but the leading contributor still made 67.5%. This leaves some concentration risk in a user-owned project.

Workflow audit

All workflows were analyzed successfully, use read-only permissions, and contain no detected injection or high-confidence audit findings. However, all 4 of 4 action references are unpinned, so workflow reproducibility and supply-chain hygiene are weaker.