mlocati/unipoints

The package is clearly documented, licensed, and recently updated, with a focused dependency set. Its single-contributor maintenance and unpinned workflow actions leave meaningful continuity and build-hygiene concerns.

Latest 1.3.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only four releases have been published since November 2023, with no releases in the last 12 months and a median interval of about 314 days. That slow cadence is a maintenance concern, although the repository was recently pushed and version 1.3.0 has release notes.

Repo bus factor

All recent repository commits came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-backed, so there is no provided organizational compensation.

Repo commit activity

One commit from one active maintainer was recorded in the last three months, showing current activity but only limited evidence of ongoing maintenance capacity.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow audit

Both workflows were analyzed without failures and avoid untrusted checkouts, script injection, and top-level write permissions. However, all eight action references are unpinned, and low-confidence cache-poisoning findings indicate build-hygiene weaknesses rather than a severe standalone risk.