phar-io/phive
The Phar Installation and Verification Environment.
68%
Total Score
caution
Usable with caveats: maintenance has gone quiet and every workflow action is unpinned.
Health Score Breakdown
The package has 42 releases, but none in the last 12 months and the latest release was about 17 months ago. This points to slowed maintenance, though the release history shows established project maturity.
The repository recorded zero commits and zero active maintainers during the last three months. Although the repository was pushed more recently than that window, the current inactivity raises maintenance risk.
There were no new or closed issues and no new or merged pull requests in the last month, while 69 issues remain open. This supports the picture of currently quiet project activity.
The repository has no security policy. This is a transparency gap for a tool that downloads and verifies software, although its other security tooling partly compensates for it.
The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 10 action references are unpinned, leaving the workflow exposed to upstream reference changes.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Arne Blankerts |
| Sebastian Heuer |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 phar-io/gnupg Version ^1.0 | — | — |
phar-io/version Version ^3.0.3 | — | — |
phar-io/manifest Version ^2.0 | — | — |
phar-io/filesystem Version ^2.0.1 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.