emonkak/orm

A single individual maintains the package, and the workflow leaves four actions unpinned. Its tests, MIT license, static analysis, and unarchived repository provide useful safeguards, but ongoing ownership looks thin.

Latest v5.0.0

Packagist

55%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publishing access, leaving limited visible publishing capacity. The repository is user-owned, so there is no organizational backing signal to compensate for that thin base.

Release history

The latest release was published on May 16, 2024, with no releases in the last 12 months, so maintenance appears stalled for more than two years. The package has nine releases over a long history, which shows it is established but does not offset the current pause.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months, consistent with more than two years since the last push. This is meaningful abandonment risk for a library dependency.

Security policy

No repository security policy was found, leaving vulnerability-reporting guidance unclear. This is a modest transparency gap rather than a severe dependency risk.

Workflow audit

The only workflow was fully analyzed with no untrusted checkouts or injection findings, but all four action references are unpinned. Missing top-level permissions is acceptable on its own; the unpinned actions remain a small reproducibility and supply-chain hygiene concern.