getpop/loosecontracts

This is a mature, actively maintained release with a six-year history, 171 releases, 33 releases in the last 12 months, a stable non-prerelease version, and a recent repository push. The package is well-scaffolded, licensed, tested, directly backed by a matching organization-owned repository, and has a small runtime dependency surface with no install-time scripts. The main concerns are that all 14 commits in the last three months came from one contributor, the repository has no security scanning or formal security policy, and repository popularity is very low; these reduce resilience and transparency but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 14 commits in the last three months, so the current operational bus factor is low. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, indicating limited adoption and external visibility. Popularity is supporting evidence rather than a decisive health criterion, so this is a caution rather than a severe risk.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. This is a transparency and preventive-maintenance gap, though it is not evidence of maliciousness by itself.

Security policy

The repository has no formal security policy. The package README provides an email reporting route, which offers some compensating disclosure guidance, but the repository-level policy gap remains.