laruence/yac

This release appears healthy and reasonable to depend on: it is a stable, non-deprecated version with a matching repository, substantial documentation, tests, changelog, explicit licensing, no install-time lifecycle scripts, and very active recent commit activity. The main concerns are that the package is only 22 days old, nearly all recent commits come from one contributor, the repository has no security policy, and most workflows do not declare top-level token permissions; these are meaningful transparency and resilience gaps, but they are partly offset by the active repository, two recent active maintainers, and workflows without detected dangerous patterns.

Latest 2.4.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account, Laruence, has publish access. This is a resilience concern for package publication, though repository activity shows active project ownership rather than abandonment.

Project backing

The repository is owned by an individual user rather than an organization, so the highly concentrated contributor activity and single registry maintainer are more significant resilience concerns.

Release history

The package has four releases over 22 days with a median interval of about 8 days. This shows active publishing, although the short history limits evidence of long-term stability.

Repo bus factor

Two contributors were active, but the leading contributor made 187 of 188 recent commits, leaving maintenance highly concentrated and creating a meaningful bus-factor risk.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning coverage is a modest transparency and security-hygiene gap.