jonmldr/path-helper

The package is easy to inspect, has a clear README, tests, an MIT license, and only one runtime dependency. Its workflow uses unpinned actions and the repository lacks a security policy, which leaves maintenance and build-integrity safeguards limited.

Latest v1.1.0

Packagist

52%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was over five years ago, with no releases in the last 12 months and only four releases overall. That strongly lowers confidence in ongoing maintenance, although a small stable utility may not need frequent releases.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package having been inactive since March 2021. The repository is not archived, but there is no recent activity to offset the abandonment risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policy

The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities. The package's small scope and simple dependency profile partly limit the concern.

Workflow audit

The single workflow was fully analyzed with no injection or high-severity findings, but both action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a build-reproducibility weakness.