davix/customs-domain
This is a promising but very young package with strong transparency and project structure: it has an MIT license, a substantial README, documentation, a matching repository, repository tests and changelog, Composer-based build tooling, active recent commits, and no deprecation or dangerous workflow indicators. The main concerns are its short 17-day history, non-stable 0.x version, sole recent contributor, absence of repository security scanning and a security policy, and workflow permissions that are not explicitly constrained. It appears reasonable to evaluate as a dependency, but its maturity and bus-factor risks warrant monitoring before relying on it for critical functionality.
78%
Total Score
80
100
83
80
Health Score Breakdown
Only one registry account has publish access, which is a modest publishing-resilience concern; the organization-owned repository provides some project backing but does not eliminate release-account concentration.
Five releases in a 17-day package lifetime, with releases roughly a day apart, show active iteration but provide little evidence of long-term maintenance or release stability.
All nine recent commits come from one contributor, creating a genuine bus-factor risk. The organization-owned repository partially compensates through potential maintenance handoff, but no second active contributor is observed.
The repository uses Composer build tooling, but no security scanning tools are configured, leaving a security-hygiene gap.
No SECURITY.md or equivalent security policy was found, reducing transparency around vulnerability reporting and response.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Davix |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1.1 || ^2.0 || ^3.0 | — | — |
psr/http-client Version ^1.0 | — | — |
psr/http-factory Version ^1.0 | — | — |
psr/http-message Version ^1.1 || ^2.0 | — | — |
psr/simple-cache Version ^1.0 || ^2.0 || ^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 15 days ago
- Created
- 1 month ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.