junjulini/plugin-project

Clear licensing, a changelog, and release notes make the package transparent to consumers. Its small dependency surface and organization backing help, but the repository has no recent development and lacks security policy or scanning. The repository matches the package, despite not naming it in the README.

Latest v1.1.2

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

Composer post-create and post-update scripts run during project creation or updates, adding execution surface for dependents. This is a mild supply-chain hygiene concern, not evidence of malicious behavior.

Release history

The package has 12 releases over about five years, but none in the last 12 months; its latest release was in September 2024, indicating materially slowed maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with no registry releases in the last year and a significant maintenance slowdown.

Repo package mention

The repository name matches the package, so it does not appear to be piggy-backing on an unrelated project. The package name is absent from the README, which slightly weakens package-to-repository transparency.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. For a maintained open-source package, that leaves a modest transparency and maintenance gap.