mosaicora/plugin-core-php

Release historycaution

The package is only 68 days old with two releases and an 11-day median interval, so it shows recent activity but has limited long-term maturity evidence.

Repo bus factorcaution

One contributor made all two recent commits, concentrating maintenance responsibility; organization backing provides some handoff capacity but does not remove the current concentration.

Repo commit activitycaution

There were two commits in the last three months, indicating recent work, though the low volume limits evidence of sustained maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest security-hygiene gap.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, all five action references are unpinned and the release workflow grants top-level write access, creating moderate workflow hygiene risk.