peopleinside/automore

This release appears generally suitable to depend on: it is non-deprecated, stable, MIT-licensed, backed by a matching active repository, and has unusually frequent recent releases with 48 commits in the last 3 months. The main risks are its short 75-day history, complete concentration of recent commits in one contributor, absence of tests and a changelog in both the artifact and repository, and lack of security-scanning tooling. These concerns warrant monitoring and review of future releases, but the current maintenance and repository hygiene signals outweigh them.

Latest 2.1.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Package scaffolding

A README and GitHub Releases are present, but neither the artifact nor repository has tests or a changelog. For a small Flarum frontend extension this is a genuine documentation and verification gap, though it is not by itself evidence of abandonment.

Project backing

The source repository is owned by the individual PeopleInside account rather than an organization, so there is no organizational handoff signal to offset the concentrated contributor base.

Repo bus factor

All 48 recent commits came from one contributor, giving the project a high single-maintainer dependency and creating a meaningful continuity risk.

Repo popularity

The repository has zero stars, forks, and watchers. This is weak supporting evidence and may reflect the package's young age, so it lowers confidence in community maturity rather than making the package unfit.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are configured. The missing scanning is a hygiene gap, while the package remains small and otherwise has explicit workflow controls.