Package Health/nowo-tech/claude-php-setup

nowo-tech/claude-php-setup

This release appears generally healthy and reasonable to depend on: it is actively released, currently stable, not deprecated, backed by a non-archived organization-owned repository, and has strong documentation, tests, changelog coverage, licensing, security policy, and dependency automation. The main concerns are a single active repository contributor over the last 3 months and workflow permission hygiene, including one workflow with top-level write access and several without explicit top-level permissions; these warrant review but do not outweigh the clear maintenance and project-structure evidence.

Latest v1.1.11

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Dangerous workflows

Six workflows were analyzed; one uses pull_request_target and another performs an untrusted checkout, but no script injection was detected. These patterns merit workflow review without constituting a severe finding by themselves.

Repo bus factor

One contributor produced 100% of the 13 commits over the last 3 months, creating a real continuity risk; organization backing provides some handoff potential but no second active contributor is evidenced.

Repo commit activity

There were 13 commits in the last 3 months, showing recent work, although all activity is concentrated in one active maintainer.

Token permissions

Five of six workflows lack top-level permissions declarations, and one workflow has top-level write access; although job-level permissions exist in four workflows, the configuration is weaker than least-privilege hygiene.