phpdot/qrcode

This is a reasonably transparent and actively published package with an MIT license, a matching source repository, clear documentation, a coherent small file tree, no install-time lifecycle scripts, and repository tests. The main concerns are its young age (53 days), pre-1.0 versioning, only three releases, three commits in the last three months all from one contributor, no security scanning or security policy, and no configured workflows. Organization ownership provides some maintenance backing for the concentrated contributor base, but the package remains relatively immature and should be adopted with normal dependency monitoring and version pinning.

Latest v0.3.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a concentration concern; however, the linked repository is owned by an organization, providing some potential maintenance handoff capacity.

Release history

The package is only 53 days old with three releases and a median release interval of about 27 days, so its maintenance and API stability history are still limited.

Repo bus factor

One contributor made 100% of the three recent commits, creating a low bus factor; organization ownership partially offsets the risk but does not demonstrate a second active maintainer.

Repo commit activity

There were only three commits in the last three months, all from one active maintainer. Recent activity is present but sparse, limiting evidence of sustained maintenance capacity.

Repo issue activity

There are no open issues or pull requests and no recent issue or PR activity. This is not inherently negative for a new small package, but it provides little evidence of community maintenance or review.