Package Health/fond-of-kudu/jellyfish-kletties

fond-of-kudu/jellyfish-kletties

The package is MIT-licensed, tested, and tied to an organization-owned repository. Its only release was 752 days ago, recent commit activity is absent, and the workflow leaves all three actions unpinned without security scanning or a security policy.

Latest 1.0.0

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

This is the sole release, published 752 days ago, with no releases in the last 12 months. That leaves little evidence of ongoing maintenance, although the repository was pushed later and is not archived.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. This supports an abandonment concern, though the package may be intentionally stable.

Repo tooling

The repository uses Make and Composer, showing basic build tooling, but no security scanning tools were detected. That is a transparency and maintenance weakness.

Security policy

No security policy was found in the repository. This is a minor transparency gap, especially alongside the absence of security scanning.

Workflow audit

All three analyzed action references are unpinned, weakening build reproducibility and update safety. The audit was complete and found no untrusted checkout, injection, or high-severity workflow issue; the missing top-level permissions block is acceptable on its own.