lion/framework

This release appears suitable for dependency use: it is a stable, non-deprecated release from a package with a consistent release history, current repository activity, matching source repository, tests, changelog, licensing, and security tooling. The main concerns are that all four commits in the last three months came from one contributor, the repository has very low adoption indicators, no security policy was found, and the workflow does not declare top-level token permissions. These merit monitoring and review of the install script, but do not outweigh the evidence of active maintenance and organizational backing.

Latest v5.1.9

Packagist

80%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

An install-time post-root-package-install script runs during installation, which adds execution surface and warrants review, although the signal does not establish that the script is unsafe.

Repo bus factor

One contributor made 100% of the four recent commits, creating a concentrated maintenance dependency; the organization-owned repository provides some backing but does not eliminate the observed single-contributor risk.

Repo commit activity

The repository recorded four commits in the last three months, showing recent activity, but all activity came from only one active maintainer.

Repo popularity

The repository has only 4 stars, 0 forks, and 0 watchers, indicating limited adoption and external validation; this is a supporting concern rather than evidence of abandonment.

Security policy

No repository security policy was found, leaving vulnerability-reporting expectations less transparent; the repository's separate security scanning tools partly compensate for this gap.