qc/qc-be-domain-color

Healthy and reasonable to adopt, with some maintenance and security-hygiene caveats. It has a current stable release, regular recent publishing, organizational backing, and a matching source repository, but recent work is concentrated in one contributor and the repository lacks a security policy.

Latest v3.0.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

A post-autoload-dump lifecycle script runs during installation. This is not inherently unsafe, but it adds installation behavior that should be reviewed before adoption.

Package scaffolding

A substantial README and changelog are present, and GitHub Releases are used. Tests are absent in both the artifact and repository, which is a modest verification gap for this extension.

Repo bus factor

All recent commits came from one contributor, creating concentration risk. This is partly mitigated because the repository is owned by an organization that can potentially hand maintenance off.

Repo commit activity

Only 1 commit was recorded in the last 3 months, showing limited direct development activity; the recent release and merged pull requests provide some compensating evidence.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured, leaving a security-process gap.