mautic/plugin-gmail

This is a mature, stable package with 88 releases since 2021, a current stable 7.2.0 release, no registry deprecation, a lightweight dependency profile, and no install-time lifecycle scripts. Its main health concern is that the linked repository is explicitly a read-only mirror with zero commits and zero active maintainers in the last 3 months; the organization backing and recent package release reduce abandonment concern, but development transparency is limited. The absence of licensing evidence, security policy, and explicit workflow token permissions, together with a pull_request_target workflow, creates additional supply-chain hygiene concerns. It is usable, but should be adopted with moderate caution and with maintenance verified in the central Mautic repository.

Latest 7.2.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

The repository has one pull_request_target workflow, which has elevated workflow-context risk even though no untrusted checkout or script-injection pattern was detected.

License

Neither a declared license nor a license file was found, leaving the legal terms of dependency use unclear.

Repo commit activity

There were zero commits and zero active maintainers in the last 3 months. The README identifies this repository as a read-only mirror and directs work to Mautic Core, which compensates for the apparent inactivity but reduces transparency in this repository.

Repo popularity

The repository has only 4 stars and 2 forks, indicating limited independent adoption evidence; the organization-backed project context makes this a supporting concern rather than a decisive health issue.

Repo tooling

Composer is used as a build tool, but no security scanning tools were detected, leaving a security-hygiene gap in the linked repository.