phar-io/composer-distributor
It has tests, a readable README, release notes for this version, and organization backing. The absence of recent maintenance means future compatibility fixes may not arrive; pin 1.0.2 if adopting it.
62%
Total Score
67
86
50
Health Score Breakdown
The release declares MIT licensing and includes a license file, while the repository also has one. The detected BSD-3-Clause text does not match the declaration, creating a small licensing clarity concern.
The package has 21 releases since November 2020, but none in the last 12 months and its latest release was nearly three years ago, indicating stalled maintenance.
The repository had no commits and no active maintainers in the last three months, which is a meaningful abandonment risk despite the repository remaining available.
There were no new or closed issues or pull requests in the last month, while three issues and two pull requests remain open; this suggests limited current project activity.
The repository has no security policy, reducing transparency for reporting and handling vulnerabilities; the absence of security scanning tools provides no compensating evidence.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Andreas Heigl |
| Arne Blankerts |
| Sebastian Feldmann |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 phar-io/gnupg Version ^1.0 | — | — |
phar-io/filesystem Version ^2.0 | — | — |
Weekly Downloads
Info
- Last Published
- 3 years ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.