moxie-lean/wp-widgets

The small dependency surface and matching source repository make the package easy to inspect. Its license, documentation, and release notes help, but the long period without maintenance makes future compatibility uncertain.

Latest 1.0.4

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs post-install and post-update Composer scripts. These add installation complexity and should be understood before adoption, although the signal alone does not show that the scripts are unsafe.

Release history

The package has 15 releases since April 2016, but its latest release was in December 2021 and it had no releases in the last 12 months. This long gap materially raises abandonment and compatibility risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this is strong evidence that maintenance has stalled.

Repo tooling

Composer is used for the build, providing standard packaging tooling, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap rather than proof of a defect.

Security policy

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear. This matters more for a package integrated into a CMS, though the signal is not evidence of a vulnerability.