grantholle/scru128

Usable with caveats: the package is clearly tied to its repository, licensed, documented, tested upstream, and has a small dependency surface. However, it is a brand-new release with no demonstrated release history, and its repository workflows include elevated write permissions and a pull-request-triggered automation job.

Latest 1.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target, which can increase automation risk when handling untrusted pull requests, although no untrusted checkout or script injection was detected in the analyzed workflows.

Release history

This is the first release and the package is 0 days old, so there is no track record of maintenance, compatibility, or response to issues yet. The same-day repository activity provides some context but does not establish long-term stability.

Repo commit activity

There are no commits or active maintainers recorded in the last 3 months, but the repository was only created or updated within the last hour and the package is 0 days old. This limits evidence of sustained maintenance rather than proving abandonment.

Repo popularity

The repository has zero stars, forks, and watchers. Because the package is newly released, this is weak maturity evidence rather than a decisive health problem.

Security policy

No repository security policy was found. This is a transparency gap for reporting vulnerabilities, though the small, new project and available Dependabot scanning partly offset the concern.