encoredigitalgroup/atlassian-sdk
Release notes document dependency updates, and the repository has tests, a license, security scanning, and organizational ownership. Workflow permissions are broad and installation runs a post-autoload hook, so pin v0.4.3 rather than floating versions.
61%
Total Score
75
93
67
Health Score Breakdown
A post-autoload-dump install script runs during Composer installation, adding execution-time supply-chain exposure, although this is a limited and common Composer hook rather than evidence of harmful behavior.
The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance slowdown, partly offset by the recent v0.4.3 release and June push.
v0.4.3 is a non-prerelease version, although the package remains below 1.0 and therefore may still make breaking changes under its stated compatibility policy.
All three workflows were analyzed with no audit findings, but all 8 action references are unpinned and two workflows grant top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is hygiene risk rather than a severe workflow threat.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Encore Digital Group |
| Marc Beinder |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 phpgenesis/http Version ^0.3 || ^1 | — | — |
illuminate/support Version ^10|^11|^12 | — | — |
encoredigitalgroup/stdlib Version ^2.0 | — | — |
Weekly Downloads
Info
- Last Published
- 7 months ago
- Created
- 2 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.