hamzi/corewatch

A substantial README, tests, release notes, MIT licensing, and a security policy improve transparency. The project is young and lightly adopted, so pin this exact version and watch for renewed maintenance.

Latest v2.1.7

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are backed by the same individual rather than an organization. That is consistent ownership, but it also indicates limited formal backing for a project already showing low recent activity.

Release history

The package has 15 releases, but they arrived in a burst over roughly 17 days and the latest release was about 3 months ago. This suggests early rapid development followed by a meaningful maintenance gap.

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last 3 months. That is a real maintenance concern, though the recent release history and non-archived status prevent treating it as abandonment by itself.

Repo popularity

The repository has 3 stars, no forks, and no watchers, indicating limited visible adoption. Popularity is supporting evidence rather than a verdict, but it provides little reassurance about project maturity.

Workflow audit

Both workflows were fully analyzed with no detected injection or high-confidence audit findings. However, all 9 action references are unpinned, and one release workflow grants top-level write permissions, creating avoidable workflow supply-chain and token-scope risk.