jacerider/neo_favicon

This is a usable and actively maintained release with 20 releases over roughly two years, five releases in the last 12 months, a recent repository push, stable versioning, tests, changelog, and no registry deprecation. The main risks are that all recent commits come from one contributor, the repository has no security policy or security-scanning tooling, and the package declares a proprietary license without a license file, which may limit transparency and reuse. Very low repository popularity adds some uncertainty but is not decisive for a focused Drupal module.

Latest 1.0.19

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

The package declares a proprietary license, and no license file was found in the artifact or repository. This is a genuine transparency and reuse concern for developers evaluating an open-source dependency.

Maintainers

Only one registry account has publish access. This is a modest operational risk, particularly because the repository is user-owned rather than organization-owned, although repository activity shows that the maintainer is currently active.

Project backing

The source repository is owned by the user account jacerider, not an organization. This provides no evidence of institutional maintenance redundancy and makes the single-maintainer activity more consequential.

Repo bus factor

One contributor made all seven commits in the last three months, creating a high bus-factor risk in this user-owned project with no organizational backing shown.

Repo commit activity

Seven commits were made in the last three months, showing current maintenance, but all were made by one active maintainer. Activity is healthy while contributor breadth remains limited.