Package Health/fond-of-oryx/business-on-behalf-product-list-connector

fond-of-oryx/business-on-behalf-product-list-connector

The package includes a full test suite, a clear MIT license, and organization-backed source code. Its workflow uses three unpinned actions, and the repository lacks a security policy, adding maintenance and build-integrity concerns.

Latest 1.0.0

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only one release, published about three and a half years ago, with no releases in the last 12 months. This is a substantial maintenance concern despite the stable 1.0.0 version.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months. Combined with the single-release history, this increases the risk that maintenance has slowed or stopped.

Repo tooling

The repository uses Make and Composer build tooling, but no security-scanning tools were detected. The established build tooling helps reproducibility, while the missing scanning is a modest hygiene gap.

Security policy

No security policy was found in the repository. This reduces transparency for reporting and handling vulnerabilities, though it is not by itself evidence that the package is unsafe.

Workflow audit

The workflow audit completed successfully with no dangerous triggers or audit findings, but all three referenced actions are unpinned. That leaves build inputs less reproducible and warrants a modest caution.