macocci7/php-boxplot

Maintainerscaution

Only one account has registry publish access. Because the repository is also owned by that same individual and releases continue, this is a limited bus factor rather than evidence of abandonment.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, despite four registry releases in the last year. The release cadence partly offsets this, but recent source activity is still quiet.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning coverage is a modest transparency and maintenance concern, not a severe risk by itself.

Security policycaution

No repository security policy was found. This reduces clarity about vulnerability reporting and response, although it does not by itself indicate unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no trigger or injection findings, but all 6 action references are unpinned. The workflow also lacks a top-level permissions block; this is acceptable on its own, while unpinned actions remain a supply-chain hygiene gap.