Package Health/legit-health/medical-device-sdk

legit-health/medical-device-sdk

This release is usable but carries meaningful maintenance and transparency uncertainty. It is MIT-licensed, includes substantial source code and tests, has no install-time scripts, is not deprecated or archived, and is backed by an organization-owned repository that was pushed recently. However, the package has only two releases across roughly 429 days, no commits or active maintainers in the last three months, no security policy or security scanning, and the linked repository does not match the package name or mention the package in its README. The organization backing and recent push are reassuring, but the limited release and commit history means this should be adopted with ordinary dependency review and monitoring rather than treated as a mature, actively maintained dependency.

Latest 2.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Release history

Only two releases have been published over roughly 429 days, with one release in the last 12 months and a median interval of about 430 days. This is a real maturity and maintenance concern for a production SDK, despite the recent 2.0.0 publication.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. The recent repository push and release indicate some current activity, but the lack of sustained commit activity still raises abandonment risk.

Repo package mention

The repository name does not match the package name and its README does not mention the package, creating uncertainty that the linked repository is the authoritative source for this release. Organization ownership and the repository's SDK-oriented contents provide some compensation, but the provenance link remains weaker than ideal.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The missing security automation reduces transparency and preventive assurance, though it is not by itself evidence of an unsafe release.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations unclear for an SDK handling medical-device API integrations.