milpa/core

Maintainerscaution

Only one account has registry publish access. This is a modest publishing bus-factor concern, though the repository is organization-owned and the active source history provides some compensation.

Repo bus factorcaution

One contributor authored all 32 commits in the last three months, creating a genuine continuity risk. Organization ownership partly mitigates handoff concerns, but no second active contributor is shown by this signal.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, so this lowers external validation but is not independently a serious health defect for a young package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanner is a security-process gap rather than evidence of poor maintenance, and other repository hygiene signals are positive.

Token permissionscaution

All analyzed workflows declare top-level permissions; one is read-only and three request write permissions. Explicit permissions are better than implicit defaults, though write access increases the impact of a workflow compromise.