pulli/pullbox

The recent pause in commits and single registry maintainer reduce confidence in ongoing support. Strong release cadence, tests, release notes, licensing, and Dependabot provide meaningful reassurance, but workflow checks still need attention.

Latest v3.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by a personal user account rather than an organization. Combined with one registry maintainer and no recent active maintainers, this indicates a thin support base.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. This is a meaningful maintenance concern, although the recent release history shows the project was active over the preceding year.

Repo popularity

The repository has zero stars and forks and only one watcher. Popularity is supporting evidence rather than a verdict, but these numbers provide little external evidence of maturity or community support.

Security policy

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it is not by itself evidence of unsafe code.

Workflow audit

All four workflows were analyzed, but all 9 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding reports spoofable actor context in the auto-merge workflow. No untrusted checkout or script-injection paths were found, which limits the severity.