loyaltylion/core

Tests, MIT licensing, and organization ownership provide useful support. Missing security policy and unpinned workflow actions reduce transparency and build hygiene; the linked repository also does not identify this package.

Latest 1.4.0

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only three releases since April 2020, with no releases in the last 12 months and a median interval of about 763 days. This indicates a slow, aging maintenance pattern for a dependency.

Repo commit activity

There were no commits from any active maintainers in the last three months. Combined with the sparse release history, this is meaningful evidence of currently quiet maintenance.

Repo package mention

The repository name does not match the package and its README does not mention the package. A monorepo can explain the name mismatch, but the lack of an explicit package reference leaves ownership and release provenance less clear.

Security policy

The repository has no security policy. For an integration that handles customer and order data, this weakens transparency about vulnerability reporting and response.

Workflow audit

The single workflow was fully analyzed with no detected injection or high-severity findings, but both of its two action references are unpinned. That leaves avoidable build reproducibility and action-substitution risk.