postboy/contract-message

Tests, a clear license, and a repository that matches the package make this small interface library straightforward to evaluate. Its organization-backed project has limited security and workflow hygiene, so future maintenance should not be assumed.

Latest v1.0.0

Packagist

55%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

This is the package's only release, published about 4 years and 5 months ago, with no releases in the last 12 months. That leaves meaningful uncertainty about continued maintenance, although a small interface package may change infrequently.

Repo commit activity

There were no commits and no active maintainers in the last 3 months, consistent with the repository having been untouched since March 2022. This is the strongest abandonment concern, though the package's narrow interface scope may reduce the need for frequent changes.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. That is a modest supply-chain hygiene gap rather than evidence that the release is unsafe.

Repository archived

The repository is not archived, so it remains available for maintenance. Its last push was about 4 years and 5 months ago, which limits the reassurance this provides.

Security policy

The linked repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This lowers transparency but is not severe on its own.