igkdev/balafon

Documentation, tests, changelog, licensing, and recent commits provide a solid foundation. Maintenance depends on one contributor, while the repository has no security policy or scanning tools, so ongoing oversight is limited.

Latest v2026.0.0.0919

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs post-autoload-dump and post-install-cmd scripts. Install-time execution adds supply-chain and installation complexity, though no evidence here shows those scripts are harmful.

Project backing

The repository is owned by an individual account rather than an organization. This does not invalidate the project, but it provides less visible organizational continuity for the single-maintainer profile.

Release history

The package has 102 releases in 301 days, with a median interval of about 35 minutes. This shows active publishing but also unusually rapid churn, which slightly reduces release confidence.

Repo bus factor

All 13 recent commits came from one contributor, leaving maintenance highly concentrated and creating a meaningful continuity risk.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. This is a modest oversight gap rather than evidence of an unsafe release.