imagewize/nynaeve

Nynaeve v4.0.1 appears suitable for dependency use: it is actively released, currently stable, not deprecated or archived, directly backed by a matching organization-owned repository, and has substantial recent commit and pull-request activity. The package is transparent and well-scaffolded with an MIT license, README, changelog, and a substantial source tree. The main concerns are a highly concentrated commit share, absence of repository security scanning and a security policy, workflows without explicit top-level permissions, no tests, and an install-time post-autoload-dump script; these warrant review but do not outweigh the strong maintenance and release evidence.

Latest v4.0.1

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package uses a post-autoload-dump install-time lifecycle script. This adds execution and review surface, although only one script is reported and no dangerous behavior is indicated by this signal alone.

Package scaffolding

A substantial README and changelog are present, and the repository uses GitHub Releases; tests are absent in both the artifact and repository, which is a minor validation gap for a theme package.

Repo bus factor

One contributor made 50 of 51 recent commits, creating substantial concentration risk. The second active contributor and organization ownership provide some maintenance handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo popularity

The repository has 9 stars, 1 fork, and 1 watcher. This is limited adoption evidence, but popularity is supporting evidence and does not outweigh the observed maintenance activity.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. The build setup is positive while the missing scanning coverage is a hygiene gap.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Ben Word

Scott Walkinshaw

QWp6t

Brandon Nifong

Jasper Frumau

Direct Dependencies

Dependency	Last Release	Score
log1x/navi Version ^3.1	—	—
roots/acorn Version ^6.0	—	—
log1x/sage-svg Version ^2.0	—	—
log1x/acf-composer Version ^3.3	—	—
blade-ui-kit/blade-icons Version ^1.7	—	—