k1low/yak

The documented README and exact-version GitHub release improve transparency, while Composer tooling and a small dependency set keep the package straightforward to inspect. There is no security policy or scanning, increasing maintenance risk for a package this old.

Latest 2.2.5

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in more than 11 years: its latest release was May 14, 2015, despite nine total releases. This long silence is strong evidence of abandonment risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history's prolonged inactivity.

Project backing

The package and repository are backed by the same individual account rather than an organization. This is consistent ownership evidence, but it offers less visible continuity than organizational backing.

Repo tooling

Composer is used as a build tool, but no security scanning tools are present. That is a modest transparency and maintenance gap, especially for an inactive package.

Security policy

The linked repository has no security policy. This is a maintenance and vulnerability-reporting gap, although it is secondary to the much longer inactivity signal.