rap2hpoutre/fast-excel

This release appears healthy and suitable to depend on: it has a long release history since 2018, 11 releases in the last 12 months, a stable non-prerelease version, no registry deprecation, an active non-archived repository, and current issue and pull-request activity. The package and repository are well documented, licensed under MIT, contain changelogs and repository tests, and include security tooling and a security policy. The main residual concern is that one maintainer account is listed and a Dependabot workflow uses pull_request_target with top-level write permissions, which warrants CI review, but these concerns are moderated by the demonstrated recent maintenance and repository-package alignment.

Latest v5.17.0

Packagist

91%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Dangerous workflows

One of three workflows uses pull_request_target, which can require careful review of untrusted pull-request execution even though no untrusted checkout or script injection was detected.

Maintainers

Only one registry account has publish access, which is a modest operational continuity concern for a user-owned project, though recent release and repository activity provides compensating evidence.

Project backing

The repository is owned by the individual rap2hpoutre rather than an organization, so institutional backing is limited; this is partly offset by the long release history and current activity.

Token permissions

Two workflows use read-only permissions, but the Dependabot auto-merge workflow has top-level write permissions; this is a contained CI privilege concern rather than evidence of package abandonment.