nepada/phpstan-message-bus

Maintainerscaution

Only one registry account has publish access. The repository is organization-owned, which makes a short registry maintainer list normal publishing hygiene, but it does not remove the risk of a thin active contributor base.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the recent release and push provide some counterevidence, this still lowers confidence in current maintenance capacity.

Repo popularitycaution

The repository has one star and no forks, offering little community evidence or redundancy. Popularity is supporting evidence only, so this is a modest concern rather than a decisive one.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, though it is less serious for a small static-analysis extension than for a package handling sensitive runtime data.

Workflow auditcaution

All workflows were analyzed and one medium-confidence high-severity bot-conditions finding was reported; the audit says actor context may be spoofable. There are no untrusted checkouts or script injections, and the workflow uses read-only permissions, so this is a contained hygiene concern.