markbaker/enumhelper

The package has a clear README, tests in the repository, release notes, a matching source repository, and a small dependency footprint. Its workflow uses all 12 actions without pinning, and the repository has no security policy, limiting transparency and build hygiene.

Latest 1.0.2

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are consistently owned by the same individual account, so the source relationship is coherent. This indicates a small maintainer base rather than organizational backing.

Release history

The latest release was published on January 20, 2022, and there have been no releases in the last 12 months. This long pause raises maintenance risk for a package whose latest stable release is still the assessed version.

Repo tooling

The project uses Composer, but no security scanning tool was detected. For a small library this is a modest transparency and hygiene gap rather than a severe dependency risk.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This lowers transparency, though it does not by itself show an unsafe release.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or script-injection findings. However, all 12 action references are unpinned, which weakens build reproducibility and makes workflow dependencies less controlled.