dreamfactory/installer

It is licensed, has a matching organization-owned repository, and has no runtime dependencies. The tiny artifact and lack of install scripts limit integration and installation complexity, but the maintenance evidence is too weak for a dependable dependency.

Latest 1.0.1

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had only two releases, both in January 2015, with no releases in the last 12 months. This long period without registry updates is strong evidence of abandonment risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last three months. Combined with the old release history, this leaves little evidence of ongoing maintenance.

Repo tooling

Composer is used for the build, but no security scanning tools were detected. This is a modest transparency and hygiene gap rather than evidence that the package is unsafe.

Repository archived

The linked repository is not archived and was pushed in December 2023, showing it has not been formally abandoned. However, that is materially older than the assessment and does not show current activity.

Security policy

The repository has no published security policy. For a small internal installer this is a limited gap, but it reduces transparency about how vulnerabilities would be handled.