divineomega/php-server-info

Registry deprecationdanger

Packagist marks the entire package as abandoned and points to the same package name as its replacement, leaving no clear supported dependency target. This is a severe adoption risk despite the repository's recent activity.

Repo bus factorcaution

All 2 recent commits came from one contributor, so maintenance depends entirely on a single person. The linked repository is user-owned, providing no organization backing to compensate for that concentration.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. This is a moderate transparency and supply-chain hygiene gap, not evidence of malicious behavior.

Security policycaution

The repository has no security policy. For a package that collects server metrics over SSH, the absence reduces reporting transparency and maintenance confidence.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous triggers or audit findings. However, both action references are unpinned, leaving dependency updates exposed to moving targets.