oscarotero/env

The package is small and well documented, with tests, a changelog, and a stable MIT release. Its lone maintainer, absent security policy, and unpinned workflow actions leave limited ongoing oversight.

Latest v2.1.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by the same individual as the registry namespace, providing clear ownership context. It is user-backed rather than organization-backed, so the maintainer base appears limited.

Release history

The package has existed since 2015 but has only 8 releases and none in the last 12 months; its latest release was nearly two years ago. This suggests slowing maintenance, although the package is mature and stable.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months. Combined with no releases in the last year, this is evidence of limited current maintenance.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. For a small library this is a modest transparency and oversight gap rather than a severe risk.

Security policy

The repository has no security policy. That makes vulnerability reporting and response expectations less clear for a dependency, despite the package's otherwise documented structure.