Package Health/humanmade/wp-pattern-library

humanmade/wp-pattern-library

This is a healthy but very young package with strong transparency and active development. It has seven releases in 44 days, recent repository activity, tests, documentation, a complete 51-file source tree, no deprecation, no install-time lifecycle scripts, and a direct repository match under an organization account. The main reservations are its immature v0.x status, very concentrated recent commit activity, absent security scanning and security policy, and incomplete workflow permission declarations; these warrant review before adoption but do not outweigh the evidence of active maintenance and solid project structure.

Latest v0.4.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Repo bus factor

One contributor made 15 of 16 recent commits, creating concentration risk. The second active contributor and organization-owned project provide partial practical mitigation, so this is a caution rather than a severe risk.

Repo popularity

The repository has only 2 stars and no forks or watchers. This is weak supporting evidence, but popularity is not decisive and the active release and commit signals compensate for the small audience.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning reduces assurance, while the otherwise structured build setup provides some compensation.

Security policy

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Token permissions

One workflow lacks top-level permissions and another grants top-level write access, so workflow privilege declarations are not uniformly restrictive. This is a hygiene concern, but the workflows show no dangerous execution patterns.