phlak/directory-lister

This is a healthy, mature release with more than six years of history, 83 releases, 12 releases in the last 12 months, a stable major version, and a recent release. The linked repository is active, unarchived, organization-backed, has tests, security policy, Dependabot scanning, CI tooling, and no analyzed dangerous workflow patterns. The main reservation is concentrated recent contribution activity: two contributors made 11 commits in three months, with one responsible for about 91% of them; the single registry maintainer is less concerning because the repository is organization-owned. The install-time post-create-project-cmd script and workflow permission omission merit review, but neither is shown to be dangerous by the available signals.

Latest 5.7.0

Packagist

88%

Total Score

Maintainer Stability

Dependencies

Maturity

100

Supply Chain

Health Score Breakdown

Dependency profile

The package declares 20 runtime dependencies, including required PHP extensions and established framework components; this is a meaningful dependency surface but not inherently unhealthy from the provided evidence.

Lifecycle scripts

A post-create-project-cmd lifecycle script runs during project creation, which adds install-time behavior that should be reviewed before adoption; no evidence here shows that it is malicious or unsafe.

Repo bus factor

Recent activity is highly concentrated: one contributor made 10 of 11 commits, or about 91%, while a second contributor made one commit. The second active contributor and organization backing partly compensate, but the concentration remains a maintenance-continuity concern.

Token permissions

The only workflow lacks top-level token permissions. No write permissions are explicitly declared, but the omission leaves least-privilege behavior less transparent and should be reviewed.