intermaterium/duckeh

This is a young but actively maintained PHP extension with 17 releases over 163 days, including a release within the assessment period, and the repository was recently pushed and is not archived. The package is transparent and reasonably well-scaffolded, with an MIT license, README, changelog, source files, and extensive tests, while its dependency profile is small and it has no install-time lifecycle scripts. Adoption risk remains meaningful because the project explicitly describes itself as early-stage, all 10 commits in the last 3 months came from one contributor, the repository has no security policy or security-scanning tooling, and it has no observed stars or forks. It is usable for developers willing to accept early-stage native-extension risk, but it does not yet demonstrate mature maintenance depth or security-process maturity.

Latest 0.7.3

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual user rather than an organization, so the concentrated contributor activity cannot be discounted as normal organizational ownership.

Repo bus factor

One contributor made all 10 commits in the last 3 months, creating a genuine single-maintainer continuity risk; the two registry maintainers do not compensate for the absence of observed repository activity from another contributor.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month; this is not inherently unhealthy for a small young project, but it provides little evidence of community engagement.

Repo popularity

The repository has zero stars, forks, and watchers. Popularity is supporting evidence rather than a verdict, but these counters provide no external adoption or community-support signal.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are detected. The lack of scanning lowers security-process maturity, though it is not by itself evidence that the package is unsafe.