laasti/spot-provider

The README, tests, changelog, and MIT license make the package easy to inspect and use. Its small dependency set and organization-owned repository help, but the project shows no recent maintenance and should be treated as an adoption liability.

Latest v2.1.1

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published in November 2016, with no releases in nearly 10 years and none in the last 12 months. This is strong evidence of abandonment for a dependency, despite the package having a stable release history earlier on.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the last push having occurred in January 2017. The lack of current development materially increases maintenance risk.

Repo popularity

The repository has one star, zero forks, and one watcher, indicating very limited community adoption or review. Popularity is supporting evidence only, but it reinforces the concern that maintenance may not resume.

Repo tooling

Composer is used for the build, showing basic project tooling, but no security-scanning tools are configured. The missing scanning is a modest transparency gap rather than evidence that the package is unsafe.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. For an old, inactive dependency this adds a modest maintenance and response concern.