printu/customerio

This is a mature, licensed, non-deprecated package with a long release history, a stable major version, a repository that matches the package, and repository tests that compensate for tests not being included in the artifact. The main concern is maintenance momentum: the repository has had zero commits and zero active maintainers in the last 3 months, despite a recent release, while popularity is modest. Missing security scanning, a security policy, and explicit workflow token permissions are transparency and CI-hygiene gaps, but the analyzed workflow shows no dangerous patterns. The package is usable, but dependency adopters should verify ongoing upstream responsiveness and be prepared to maintain or fork it if activity remains dormant.

Latest 3.7.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one account has registry publish access. This is a modest operational bus-factor concern, although the repository is owned by an organization, which provides some compensating project backing.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. This is the clearest health concern because it indicates currently dormant maintenance, despite the recent registry release.

Repo issue activity

There are only 2 open issues, no open pull requests, no new issues in the last month, and 1 merged pull request. The low issue load is positive, but it also provides little evidence of an active maintenance community.

Repo popularity

The repository has 25 stars, 14 forks, and 3 watchers. This is modest supporting evidence and does not independently indicate unfitness, but it suggests a limited external contributor and review pool.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured. The absence of scanning lowers supply-chain transparency, though it is not by itself evidence that the package is unsafe.