Package Health/fastmon/shopware-collector

fastmon/shopware-collector

This release appears reasonably safe to adopt from a supply-chain health perspective: it is backed by an active organization-owned repository, has substantial recent commit and merge activity from three contributors, includes tests, documentation, a license file, and no install-time lifecycle scripts or dangerous workflow patterns. The main reservations are that the package is extremely new, remains below 1.0, has no observable popularity yet, lacks repository security scanning and a security policy, and has incomplete top-level workflow permission declarations. These concerns warrant monitoring and careful pinning, but the available evidence does not indicate abandonment or an otherwise unfit dependency.

Latest 0.1.1

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases have appeared, both within about one hour, and the package age is 0 days. This shows active initial publication but provides almost no long-term maintenance history.

Repo popularity

The repository has zero stars, forks, and watchers. This is a maturity and external-validation gap for a package released today, although low popularity alone is not evidence of abandonment.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning reduces assurance around ongoing dependency and code hygiene.

Security policy

The repository has no security policy. This is a genuine transparency and vulnerability-reporting gap, though it does not by itself indicate that the package is unsafe to depend on.

Token permissions

Two of three workflows lack top-level permission declarations, while none declares top-level write access and one explicitly uses read-only permissions. The absence of explicit defaults is a modest hardening concern, not a severe workflow risk.