netflex/log

The package is small, clearly licensed, and has a matching organization-owned repository. Its dependency surface is narrow, but the repository shows no commits in three months and the workflow uses an unpinned action with broad write permissions.

Latest v7.0.1

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 289 releases over nearly five years, but only one release in the last 12 months; this indicates a sharp slowdown despite a substantial historical record.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months, which is a concrete maintenance concern for a package intended to be depended on.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policy

The repository has no security policy. For a small logging component this is a limited governance gap, but it reduces clarity about vulnerability reporting.

Workflow audit

The only workflow has a pull_request_target trigger without an untrusted checkout or script-injection sink, so the trigger is not dangerous on its own. However, its action is unpinned and the workflow grants top-level write permissions, creating moderate supply-chain hygiene concerns.