joesama/webhook

MIT licensing, a clear README, tests, and a small dependency set make adoption straightforward. The single maintainer, absent security policy, and minimal repository activity leave limited evidence of ongoing support.

Latest 4.1

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are owned by the same individual account. This is coherent ownership, but it does not provide the resilience of organization backing.

Release history

The package has existed for about 6 years but only 5 releases, with a median interval of about 382 days and just 1 release in the last 12 months. This indicates a slow maintenance cadence, although a recent release shows the project is not abandoned.

Repo commit activity

There were zero commits and zero active maintainers in the last 3 months. The same-day repository push and package release partly offset this, but ongoing maintenance capacity remains uncertain.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, not evidence of unsafe code.

Workflow audit

Both workflows were analyzed completely and have no untrusted checkouts or script injection, but the audit found a high-confidence unpinned container image and both action references are unpinned. This weakens build reproducibility and supply-chain hygiene.