nodesol/lightcms

The MIT license, repository tests, changelog, and organization backing improve transparency. Its narrow runtime dependency set also limits integration burden, but the project offers little evidence of current care.

Latest 1.0.3

Packagist

40%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had four releases, but none in the last 12 months and no release since March 2024 despite being assessed more than two years later. This is strong evidence of abandonment risk.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. No provided activity signal compensates for this lack of recent maintenance.

Security policy

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. Dependabot provides some compensating security tooling, but not a clear reporting process.

Workflow audit

All 12 analyzed action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. There is no untrusted checkout or script-injection finding, so this is a hygiene and supply-chain caution rather than a standalone severe risk.