phpunit/php-token-stream
The package is clearly licensed, documented, and built with static analysis. Its single publisher, absent security policy, and unpinned CI actions leave modest resilience and supply-chain concerns.
58%
Total Score
50
83
50
Health Score Breakdown
The package has a substantial history with 37 releases since 2012, but it has had no release in nearly five years; that strongly raises abandonment risk.
One registry maintainer is consistent with a package published under an individual project owner, but it provides little redundancy if that maintainer stops supporting it.
The repository recorded 0 commits and 0 active maintainers in the last three months, consistent with the old latest release and indicating inactive maintenance.
The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented; this is a transparency gap for a dependency.
The single workflow was fully analyzed with no detected dangerous sinks or audit findings, but all 7 action references are unpinned, leaving avoidable update and provenance risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Sebastian Bergmann |
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 6 years ago
- Created
- 14 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.