Package Health/klaviyo/magento2-extension

klaviyo/magento2-extension

This is a mature, actively maintained Magento extension with a release history dating to 2017, 76 releases, nine releases in the last 12 months, a recent stable release, five active contributors and 50 commits in the last three months. The repository is not archived, is organization-owned, includes tests, changelog, CI/CD workflows, and build tooling, and the package has no install-time lifecycle scripts or registry deprecation. The main concerns are that no license declaration or license file was detected, the linked repository neither matches the package name nor mentions it in its README, and repository security hygiene is incomplete because no security policy or top-level workflow permissions were found. These transparency and security-process gaps warrant caution, but the strong maintenance and project-backing evidence makes the package generally reasonable to depend on after confirming licensing and repository identity.

Latest 5.2.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

Neither a declared license nor a license file was detected, leaving the legal terms for consuming and redistributing this dependency unclear.

Repo issue activity

Recent activity is mixed: one pull request was opened and two were merged in the last month, but no issues were opened or closed, while 25 issues and 14 pull requests remain open. This suggests some backlog but not abandonment.

Repo package mention

The repository name does not match the package name and the README does not mention the package, so the linkage between the Packagist package and source repository is not transparently established by the collected evidence.

Repo tooling

The project uses Make and Composer build tooling, but no security scanning tools were detected; the build process is established while automated security coverage is a gap.

Security policy

No repository security policy was found, reducing transparency around vulnerability reporting and coordinated disclosure.