getpop/guzzle-helpers

This release shows strong evidence of ongoing maintenance: it has a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, recent repository activity, tests, a license, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist with no replacement, which is a major dependency risk despite the repository remaining active. Maintenance is also concentrated in one contributor, the linked repository does not identify or mention this package, and there is no repository security policy or security-scanning tooling. This package may still function, but the abandonment status and transparency concerns make adopting it a liability without confirming the maintainer's migration or support plan.

Latest 19.2.4

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned via packagist_abandoned, with no replacement package specified. This is a severe dependency-health warning even though other signals show recent development activity.

Maintainers

Only one registry account has publish access. Because the source repository is organization-owned, this is not by itself a severe concern, but it still indicates limited observed publishing redundancy.

Repo bus factor

One contributor made all 16 commits in the last 3 months. The organization-owned repository provides some handoff capacity, but the observed contributor concentration remains a genuine continuity risk.

Repo package mention

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent and the package could be piggy-backing on a broader project repository.

Repo tooling

Composer is used as the build tool, but no security-scanning tools are detected. The missing scanning coverage is a transparency and maintenance gap, though it is not evidence of malicious behavior.