lemaur/markdown

This is a healthy, actively maintained release with a five-year history, nine releases in the last 12 months, a stable non-prerelease version, and no registry deprecation. The linked repository is active and unarchived, matches the package, contains tests and changelog material, uses Composer and Dependabot, and publishes a security policy. The main risks are a single active maintainer with all recent commits, very low repository popularity, an install-time post-autoload-dump script, and some GitHub Actions workflows with broad or unspecified token permissions; these warrant review but do not outweigh the strong release and repository maintenance evidence.

Latest 4.0.1

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Dangerous workflows

Six workflows were analyzed; one uses pull_request_target, but there are no untrusted checkouts or script-injection findings. The isolated pull_request_target usage merits review but is not severe on the available evidence.

Lifecycle scripts

The package declares a post-autoload-dump install lifecycle script. This adds installation complexity and should be reviewed before adoption, although the signal alone does not establish that the script is unsafe or damaging.

Maintainers

Only one registry account, Maurizio, has publish access. This is a real publishing continuity concern, though the repository shows ongoing activity from the same maintainer.

Project backing

The repository owner is an individual user rather than an organization. Combined with the single recent contributor, this provides less maintenance redundancy than organization-backed ownership.

Repo bus factor

One contributor made all 4 commits in the last 3 months, giving a 100% top-contributor share. This creates a meaningful continuity and bus-factor concern for a user-owned project.