imiphp/imi-hprose

Documentation is adequate, licensing is clear, and the organization-owned repository matches the package. Install-time scripts and an unpinned workflow add smaller supply-chain concerns. The maintenance evidence is too old for a dependable current dependency.

Latest v2.1.11

Packagist

44%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 31 releases since December 2018, but none in the last 12 months and the latest release was over three years ago. This indicates substantial abandonment risk despite a previously regular release interval.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. No provided signal shows recent maintenance capacity.

Lifecycle scripts

The package runs pre- and post-install/update Composer scripts, which increase execution-time supply-chain exposure compared with a package without lifecycle hooks. This is a concern, but not severe enough to determine the health band alone.

Security policy

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a hygiene gap that compounds the weak maintenance evidence.

Workflow audit

The single workflow is fully analyzed with no reported audit findings or untrusted checkout, but its one action use is unpinned. The pull_request_target trigger is ordinary here because no dangerous sink was detected.