Package Health/revoltify/subscriptionify

revoltify/subscriptionify

This is a usable and reasonably transparent young package: it is not deprecated or archived, has a matching public repository, a clear MIT license, repository tests and releases, active recent commits, dependency-update tooling, and no observed dangerous workflow patterns. The main concerns are limited maturity with only three releases over 153 days, five commits from a single contributor in the last three months, no packaged README or changelog, no security policy, and workflows without explicit top-level token permissions. Organization backing and repository tests partly compensate for the thin individual maintainer base and artifact documentation gaps, but the package should still be adopted with awareness of its concentrated maintenance risk.

Latest 1.0.2

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Release history

The package is young at 153 days with three releases and a median release interval of about 77 days; this shows some release activity but not yet long-term maturity.

Repo bus factor

All five recent commits came from one contributor with a 100% share, creating a genuine bus-factor concern; organization ownership provides some potential handoff capacity but does not demonstrate a second active contributor.

Repo commit activity

Five commits were made in the last three months, showing recent activity, but all were produced by one active maintainer, limiting evidence of broader maintenance capacity.

Security policy

No security policy was found in the repository, leaving vulnerability-reporting expectations and disclosure procedures less transparent.

Token permissions

Neither workflow declares top-level token permissions, which is a workflow-hardening gap even though no write permissions were explicitly observed.