drupflare/stream-http

This is a young but actively developed package with four releases in 27 days, recent repository activity, a non-deprecated release, clear MIT licensing, a matching source repository, and a small dependency surface. The repository contains tests and substantial documentation even though tests are not packaged. However, maintenance is concentrated entirely in one contributor, the project has minimal adoption, no security scanning or security policy, and its GitHub Actions workflows do not declare top-level token permissions. The package is reasonable to adopt with normal dependency review, but its short history and single-maintainer structure create meaningful continuity and supply-chain transparency risk.

Latest v0.1.3

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. The organization-backed repository provides some project continuity, but publishing remains operationally concentrated.

Release history

Four releases over 27 days, with a median interval of about 8 days, show active early development, but the package has too little history to establish long-term maintenance reliability.

Repo bus factor

All 34 recent commits were made by one contributor, creating a substantial continuity and abandonment risk. Organization ownership partly mitigates handoff risk, but no second active contributor is evidenced.

Repo popularity

The repository has only 1 star and no forks, so external adoption and validation are minimal; this is supporting caution rather than a standalone health verdict.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured, leaving a security-hygiene gap in the repository.