Package Health/networkrailbusinesssystems/directory-link

networkrailbusinesssystems/directory-link

This release appears generally healthy and reasonable to depend on: it is not deprecated or archived, has an organization-owned repository with recent activity, a substantial test suite, clear documentation, a license file, and a modest runtime dependency footprint. The package is still young at 28 days old, and all 31 recent commits come from one contributor, which creates a meaningful continuity risk despite the organization backing. Missing security scanning and a repository security policy are additional hygiene gaps, but the repository has safe workflow findings and the package shows strong early maintenance activity.

Latest 1.2.6

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is very young at 28 days old, which limits evidence of long-term durability, but 13 releases in that period show active iteration rather than abandonment.

Repo bus factor

One contributor produced all 31 commits in the last three months, creating a genuine single-maintainer continuity risk; organization ownership provides some ability to hand maintenance off but does not eliminate the concentration.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a security-hygiene gap that lowers confidence without independently indicating abandonment.

Security policy

No repository security policy was found, reducing transparency around vulnerability reporting and response expectations.

Token permissions

The repository's sole workflow lacks top-level token permissions. Although no write permissions were explicitly declared, explicit least-privilege configuration would provide stronger CI hygiene.