lcoy/waterfall

Tests, a clear MIT license, and no install scripts improve the release's transparency. The project is only 7 days old, all 20 recent commits come from one contributor, and its workflow references are unpinned. Its repository is active and not archived, but the long-term maintenance picture is still limited.

Latest 1.2.1

Packagist

63%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual account rather than an organization, so the single-maintainer concentration is not visibly offset by broader project backing.

Release history

The package is only 7 days old, despite 14 releases in that period; this shows active initial work but gives little evidence of sustained maintenance.

Repo bus factor

One contributor made all 20 recent commits, creating a meaningful continuity risk if that maintainer becomes unavailable.

Repo tooling

The repository uses Composer, but no security-scanning tooling was detected; the missing scanner is a modest transparency gap rather than a standalone severe risk.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a package that handles uploads and external image hosting.