innmind/ip

Clear documentation, a changelog, and a recent tagged release make the package easy to evaluate. Maintenance is concentrated in one contributor, while both workflows pass secrets broadly and use five unpinned actions.

Latest 4.1.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All three recent commits came from one contributor, so maintenance continuity is concentrated despite the repository being owned by an organization.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest repository hygiene gap.

Security policy

The repository has no security policy, reducing transparency about how vulnerability reports should be handled.

Workflow audit

Both workflows were analyzed successfully and have no untrusted checkouts or script injection, but all five action references are unpinned and both workflows use high-confidence secrets-inherit findings. These are meaningful supply-chain hygiene concerns even without a dangerous trigger.