guanguans/music-php

The repository has tests, release notes, security scanning, and a security policy. Workflow checks need attention, and the package-to-repository naming mismatch reduces transparency; the recent work is concentrated in one maintainer.

Latest 7.1.13

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

Post-install and post-update scripts run during Composer operations, adding execution surface for consumers. No provided signal shows these scripts are unsafe, so this is a limited supply-chain concern rather than a severe risk.

Project backing

The source repository is owned by a user rather than an organization, so the concentrated recent contribution profile is not offset by clear organizational handoff capacity.

Repo bus factor

All recent commits come from one contributor with a 100% share, creating a meaningful continuity risk for a user-owned project.

Repo commit activity

Only 2 commits were made in the last 3 months, with one active maintainer, so current maintenance activity is thin despite frequent registry releases.

Repo package mention

The repository name does not match the package name and its README does not mention the package, making the package-to-source relationship less transparent even though the repository appears related by owner and content.