mrsuh/php-parser

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has clear ownership linkage. It does not provide organizational backing to offset maintainer concentration.

Repo bus factorcaution

Three contributors were active in the last three months, but the leading contributor made 75% of commits. The presence of two additional active contributors partly offsets the concentration, leaving only a mild resilience concern.

Repo toolingcaution

The project uses Make and Composer for builds, which supports repeatable development. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was detected. This does not show unsafe code, but it reduces transparency about vulnerability reporting and response.

Workflow auditcaution

Both workflows were analyzed successfully and had no untrusted checkouts, script injection, or high-severity findings. However, all 14 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.