marketflow/yii2-totp

The package is small, clearly licensed, and backed by an organization with a simple Composer dependency set. Its documentation and security process are thin, so maintenance and integration risks would largely fall on adopters.

Latest v0.2

Packagist

35%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published in July 2018, with no releases in the following eight years and only two releases overall. This is strong evidence of abandonment risk for a dependency that may need compatibility or security updates.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no activity since July 2018. The organization backing does not compensate for the absence of observed maintenance.

Package scaffolding

The published artifact has no README, tests, or changelog. Missing tests and changelog are normal for published artifacts, but the missing README is a real integration gap for a Yii2 library; the GitHub release itself provides some release transparency.

Repo tooling

Composer build tooling is present, but no security-scanning tooling was detected. That limits automated checks, although the absence of scanning alone is not evidence of a vulnerability.

Security policy

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is more concerning for a package implementing two-factor authentication.