ozz/framework

Frequent recent releases show active maintenance, but all recent commits come from one contributor and the repository has no security scanning or policy. The MIT declaration and stable release history provide useful reassurance.

Latest 1.4.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Maintainers

Only one registry account has publish access. This is a concern for publishing continuity, though the repository's recent activity shows that the package is currently maintained.

Package scaffolding

The release includes GitHub notes for this version, and missing tests or a changelog in the published artifact is normal packaging practice. The absent README is a minor consumer-documentation gap for a framework.

Project backing

The repository is owned by an individual user rather than an organization, so the single-contributor and single-publisher risks are not offset by visible organizational backing.

Repo bus factor

All 41 commits in the last 3 months came from one contributor, creating a meaningful continuity risk with no provided organizational backing to compensate for the concentration.

Repo popularity

The repository has no stars or forks and only one watcher, indicating limited public adoption. Popularity is supporting evidence, so this lowers confidence more than it determines the verdict.