imyfone-tp/captcha

The package has a clear README, a small dependency set, and no install-time scripts. Its license mismatch and absent security policy add transparency concerns alongside the stalled project activity.

Latest v1.0.0

Packagist

46%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

The artifact includes a license file and the repository also has one, but the manifest declares Apache-2.0 while the detected file is MIT. That mismatch should be resolved before adoption.

Project backing

The repository is owned by an individual user rather than an organization, so there is no demonstrated organizational backing to offset the single-release and inactive-maintenance profile.

Release history

This is the only release, published about five and a half years ago, with no releases in the last 12 months. That leaves meaningful abandonment risk despite the package not being deprecated.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. Combined with the last push in March 2021, this indicates a project with no observed current maintenance.

Repo tooling

Composer is used for builds, which fits the package ecosystem, but no security scanning tools are present. The missing scanning is a modest hygiene gap rather than evidence of abandonment by itself.