Package Health/hamaadraza/php-impersonate

hamaadraza/php-impersonate

This release appears healthy and reasonably safe to depend on: it is a stable major release with recent, recurring releases, an active and non-archived repository, documented licensing, substantial README and changelog coverage, repository tests, low runtime dependency count, and no install-time lifecycle scripts. The main concerns are concentrated maintenance: all 13 commits in the last 3 months came from one contributor, and the repository lacks a security policy. Several workflows also grant top-level write permissions and one uses pull_request_target, which warrants CI-security review, although no untrusted checkouts or script-injection patterns were detected. Overall, the package is usable with moderate supply-chain and continuity precautions rather than being unfit for adoption.

Latest v2.0.0

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Dangerous workflows

One of four workflows uses pull_request_target, which requires careful review, but no untrusted checkout or script-injection patterns were detected. The workflow profile is therefore a review concern rather than a severe health failure.

Maintainers

Only one account has registry publish access. Because the repository is user-owned rather than organization-backed, this represents a real continuity concern, though active repository evidence provides partial compensation.

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational handoff signal to offset the concentrated maintainer base.

Repo bus factor

All 13 recent commits came from a single contributor with a 100% share, creating a meaningful bus-factor and abandonment-continuity concern in a user-owned project.

Security policy

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.