leongrdic/smplang

The MIT license, small dependency set, repository tests, and release notes provide useful transparency. The project is not archived, but its long inactivity and workflow pinning gaps make continued maintenance less certain.

Latest 1.0.2

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no release in about four years, with only three releases overall and none in the last 12 months. This is strong evidence of inactivity, though the stable 1.0.2 release may still be serviceable.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, reinforcing the long gap since the latest release. This raises maintenance and abandonment risk.

Repo issue activity

There were no new or closed issues or pull requests in the last month, while one issue and two pull requests remain open. This is consistent with limited recent project activity.

Security policy

The repository has no security policy and no security-scanning tools were reported. This is a transparency and maintenance gap, although it is not evidence that the package is malicious.

Workflow audit

All seven analyzed action references are unpinned, and the audit found a high-confidence high-severity unpinned container image. The workflows use no dangerous untrusted triggers or writable top-level permissions, which limits the risk.