mmtech/iam-rbac

This is a usable but relatively young package with strong artifact hygiene: it includes a substantial README, tests, changelog, source code, and a nontrivial dependency profile, and it has released 14 stable versions over 130 days with the latest release very recent. The linked repository is active, unarchived, organization-owned, and clearly references the package. However, maintenance evidence is narrow: only one commit from one contributor was observed in the last three months, with no issue or pull-request activity, and the repository has no security scanning or security policy. The proprietary license declaration may also restrict adoption and redistribution despite license files being present. Overall, it is reasonable for controlled use, but its short history and concentrated maintenance warrant caution before making it a critical dependency.

Latest v1.13

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

The package declares a proprietary license, which can restrict redistribution and make it unsuitable for projects requiring an open-source license. The release does include a license file, so this is a licensing-compatibility concern rather than an absence of licensing information.

Release history

The package has 14 releases over 130 days, with all 14 released within the last 12 months and a median interval of about 18 hours. This demonstrates active publishing, though the short overall history limits evidence of long-term stability.

Repo bus factor

All observed recent commits came from one contributor, creating a concentrated maintenance dependency. Organization ownership provides some capacity for handoff, but no second active contributor is evidenced by this signal.

Repo commit activity

Only one commit by one active maintainer was observed over the last three months. Despite the recent push and rapid registry releases, this is thin direct evidence of sustained source maintenance.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. This is not inherently unhealthy, but it provides little evidence of an active public maintenance community.