nexorams/sdk

This release has solid initial engineering and transparency indicators: it is MIT-licensed, includes a substantial README, changelog, tests, a complete source tree, Composer-based build tooling, security scanning, and a workflow without the analyzed dangerous patterns. The main limitation is maturity: the package is less than a day old with only two releases, zero observed commits or active maintainers in the three-month window, and no repository security policy. Those activity metrics are not yet strong abandonment evidence because the project is newly published, but they leave maintenance continuity unproven. The organization-backed repository and explicit package reference are reassuring, so the package is usable but should be adopted with monitoring rather than treated as mature.

Latest v1.0.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is extremely new, with only two releases since its first publication less than a day ago; this limits evidence of sustained maintenance and release discipline.

Repo commit activity

No commits or active maintainers were observed in the three-month window. This is a meaningful maintenance-visibility gap, although the package's age means the window largely predates publication.

Repo popularity

The repository has zero stars, forks, and watchers. Given that it was created very recently, this is weak maturity evidence rather than a standalone health failure.

Security policy

No security policy is present in the repository, leaving vulnerability-reporting and security-response expectations undocumented.

Token permissions

The sole workflow lacks top-level GitHub token permissions. Although no write permissions are explicitly requested, least-privilege intent is not clearly declared.