johnrdorazio/simpleapi

The single maintainer, absent recent security tooling, and install-time script add maintenance and operational concerns. The Apache-2.0 license, focused dependency set, substantial README, and matching repository provide useful transparency.

Latest v0.1.3

Packagist

45%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in more than three years and no releases in the last 12 months; its four releases were concentrated at the start of the project. This is strong evidence of abandonment risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating no visible ongoing maintenance.

Lifecycle scripts

The package runs a post-install-cmd script, which adds install-time behavior that consumers must account for; no provided signal shows that this script is unsafe, so the effect is limited to caution.

Maintainers

One registry maintainer creates a thin publishing base and increases continuity risk, although the linked repository is owned by the same individual.

Security policy

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This matters for a library intended to support APIs.