Package Health/hypejunction/hypenotifications

hypejunction/hypenotifications

The repository still has two active contributors and four commits in the last three months, with tests and release notes. The license mismatch and 11 unpinned workflow actions reduce transparency and reproducibility.

Latest 2.1.2

Packagist

44%

Total Score

Maintainer Stability

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the entire package abandoned, with no replacement provided; this is a strong adoption and maintenance warning even though the repository remains active.

Release history

The latest registry release was in July 2018, with no releases in roughly eight years. Recent repository activity partly offsets the stale registry publication record but does not remove the release risk.

License

The manifest declares a proprietary license while the repository license file is recognized as GPL-2.0. The repository is licensed, but the mismatch creates avoidable uncertainty for consumers.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This is a transparency gap for a notification and email-handling plugin.

Workflow audit

The audit completed cleanly with no untrusted checkouts, injection findings, or excessive permissions, but all 11 action references are unpinned, weakening build reproducibility.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Ismayil Khayredinov

Direct Dependencies

Dependency	Last Release	Score
guzzlehttp/guzzle Version ^6.3	—	—
pelago/emogrifier Version ~1.0	—	—
sendgrid/sendgrid Version ^6.0	—	—
composer/installers Version ~1.0	—	—
mailgun/mailgun-php Version ^2.4	—	—