jbboehr/yumemi-apocrypha

This is a young but actively developed development-tooling package with clear licensing, documentation, changelog, source repository alignment, repository tests, and substantial recent commit activity. Its main risks are the short 22-day history, provisional 0.x API, complete dependence on one contributor, absent security-scanning tooling and security policy, and minimal adoption evidence; these make it usable with monitoring rather than a highly mature dependency. The repository is not archived or deprecated, has no install-time lifecycle scripts, and its workflow risk profile is clean, which provides meaningful reassurance.

Latest v0.3.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. This is a genuine publishing continuity concern for an individually owned project, although repository activity shows that the maintainer is currently active.

Project backing

The repository owner is an individual user rather than an organization, so there is no demonstrated organizational handoff or backing to offset the single-maintainer concentration.

Release history

The package is only 22 days old with three releases and a median interval of about 11 days, providing evidence of active early development but little long-term maintenance history.

Repo bus factor

All 98 recent commits come from one contributor, creating a high bus-factor risk. The owner is actively contributing, but no second active maintainer is shown to provide continuity.

Repo issue activity

There are no open issues or pull requests and no recent issue or pull-request activity. This is not inherently negative for a package only 22 days old, but it provides little evidence of external review or maintenance collaboration.