infw/event-sourcing

The MIT license and modest runtime dependency set make the package straightforward to evaluate. Its source repository has no security policy or scanning, and the repository does not clearly identify the package in its README.

Latest 1.0.2

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only 3 releases, all concentrated in October–November 2017, with no releases in the last 12 months despite being about 9 years old. This is strong evidence of abandonment risk.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the release history showing no activity since November 2017.

Package scaffolding

The published artifact has no README, tests, or changelog, and the repository also reports no tests or changelog. Although missing tests and changelogs can be normal packaging practice, the missing consumer documentation is a meaningful transparency gap for a library.

Repo package mention

The repository name does not match the package name and no README package mention was observed. This creates some uncertainty that the linked repository is the intended project, although a name mismatch can be normal for subpackages.

Security policy

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This adds a modest transparency concern but does not by itself make the release unfit.