packstub/partisan

This is a young but actively maintained package with a clear MIT license, matching repository, complete source scaffolding, repository tests, changelog, security policy, Dependabot, and recent release activity. The main concerns are its short 31-day history, pre-1.0 version, single active contributor, and GitHub Actions permissions that are broader than necessary; these warrant caution for long-term dependency adoption, although the organization-owned repository and recent merged pull requests provide some backing and maintenance evidence.

Latest v0.2.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated workflow risk, although no untrusted checkout or script injection was detected.

Maintainers

Only one registry account has publish access, which is a modest publishing continuity concern; the organization-owned repository provides some compensating project backing.

Release history

The package is only 31 days old with two releases about 31 days apart, so its maintenance and compatibility track record are still limited.

Repo bus factor

All 11 recent commits came from one contributor, creating a real bus-factor risk; organization ownership provides some potential handoff capacity but does not demonstrate a second active maintainer.

Repo commit activity

Eleven commits occurred in the last three months, but all were made by one active maintainer; activity is recent but the contributor base is thin.