extport/protobuf

The mirror has active automated releases, tests, and a changelog, with organization backing. One maintainer owns all five recent commits, while broad workflow write permissions and template-injection findings reduce confidence in its automation hygiene.

Latest 36.2

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all five recent commits, creating a genuine continuity risk. Organization ownership provides some ability to hand off maintenance, but no second active contributor is evidenced.

Repo tooling

Composer is used for builds, but no repository security-scanning tool was detected. For an automated binary mirror, this is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policy

The repository has no security policy, leaving reporting and response expectations undocumented for a package that distributes extension source and binaries.

Workflow audit

All four workflows were analyzed and all 12 action references are pinned, with no untrusted checkouts or script-injection findings. However, three workflows grant top-level write permissions and the build workflow has high- and medium-confidence template-injection findings; without an untrusted trigger these are workflow-hygiene concerns, not a severe standalone risk.