getpop/engine

This is a healthy, actively released package with a long history, 162 releases including 33 in the last 12 months, a stable non-prerelease version, a non-deprecated registry status, clear licensing, tests, a matching repository, and a lightweight dependency profile. The main concerns are that all 15 recent commits came from one contributor, the repository has no security scanning or security policy, and no changelog was found in either the artifact or repository; however, the repository is organization-owned, active, not archived, and the package is well-scaffolded, so these are cautionary hygiene and bus-factor issues rather than evidence that the package is unfit to depend on.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has a substantial README and tests, and the repository also has tests. A changelog is absent from both locations, which is a modest transparency gap because the README directs users to one.

Repo bus factor

One contributor made all 15 commits in the last 3 months, producing a top-contributor share of 100% and a genuine continuity risk. Organization ownership provides some backing, but no second active contributor is shown to offset the concentration.

Repo issue activity

There were no new or merged pull requests and no new or closed issues in the last month; this is ambiguous because open issue count is unavailable, so it is a limited activity concern rather than strong abandonment evidence.

Repo popularity

The repository has only 3 stars, 0 forks, and 1 watcher. This is weak supporting evidence, but popularity is not decisive and the package's release and commit activity provide stronger maintenance evidence.

Repo tooling

Composer is used as a build tool, but no security-scanning tool is detected. The build tooling is appropriate, while the missing scanning is a security-hygiene gap.