mautic/plugin-crm

This is a generally usable and actively released package with a long release history, a stable current version, organization backing, tests, and no registry deprecation or install-time scripts. However, the linked mirror repository shows no commits or active maintainers in the last 3 months, the package and repository have no detected license file or declaration, and the repository lacks security-scanning and security-policy coverage. The pull-request-target workflow without explicit top-level token permissions adds supply-chain hygiene concern, although the README explains that development is centrally managed in Mautic Core and the latest registry release is recent.

Latest 7.2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

The repository has one pull_request_target workflow, which can be sensitive when handling untrusted pull requests. No untrusted checkout or script-injection pattern was detected, limiting the severity but leaving workflow risk to review.

License

Neither a declared license nor a license file was detected in the artifact or repository, leaving the legal terms of dependency use unclear.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers over the last 3 months, which is a meaningful maintenance-visibility gap. The package's recent release history and README-documented central management partially compensate, but do not remove the concern for this mirror.

Repo popularity

The repository has low popularity with 8 stars and 1 fork, but popularity is supporting evidence only and the organization backing, tests, and release cadence provide stronger context.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected, reducing automated supply-chain and code-security hygiene.