emleons/sim-rating

The MIT license, focused dependency set, README, and repository tests make the package easy to inspect and adopt. However, it has had no release or repository commit activity for about 14 months, and its workflow uses broad permissions with all five actions unpinned.

Latest v2.1.2

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has six releases, but all appear concentrated on one day and there have been no releases in the last 12 months. That pattern provides little evidence of ongoing maintenance.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. Combined with the absence of releases over the last year, this is a meaningful abandonment concern.

Repository archived

The linked repository is not archived, but its last push was about 14 months ago, which is consistent with the separate evidence of stalled maintenance.

Security policy

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although it is less severe than the observed maintenance slowdown.

Workflow audit

The single workflow grants top-level write permissions and all five analyzed action references are unpinned. No untrusted checkout, injection, or high-confidence audit findings were reported, so this is a moderate hygiene concern rather than a severe risk.