Package Health/nosto/module-nostotagging

nosto/module-nostotagging

Version 9.0.3 appears healthy to depend on: the package has a long release history dating from 2016, 213 releases, 12 releases in the last 12 months, and a recent stable release. Its repository is active and not archived, with 80 commits from four maintainers in the last three months, substantial pull-request merging, tests, a changelog, build tooling, Dependabot scanning, and no observed dangerous workflow patterns. Licensing and package structure are clear, and the repository README references the package despite the repository name differing from the package name. The main reservations are the absence of a security policy and explicit top-level workflow permissions, which are repository hygiene gaps rather than evidence of abandonment; the package's low popularity is also only a modest concern.

Latest 9.0.3

Packagist

91%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo popularity

The repository has 27 stars, 29 forks, and 8 watchers, which is modest popularity. This is only a minor caution because popularity is supporting evidence and the activity signals are strong.

Security policy

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency. This is a genuine hygiene gap but not evidence that the package is unmaintained.

Token permissions

All 4 workflows lack top-level permissions declarations. Although none declares top-level write access, explicit least-privilege permissions would provide stronger CI security assurance.