Package Health/ryangjchandler/blade-capture-directive

ryangjchandler/blade-capture-directive

Usable with caveats: the package is clearly backed by a matching repository, has a recent stable release, tests, release notes, and security tooling. However, there have been no commits or active maintainers in the last three months, and the workflow permissions need tightening.

Latest v1.1.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target, which warrants care because it can run with elevated repository context. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Project backing

The registry namespace and repository owner match the same individual, which is consistent with a small personal open-source project. It provides direct ownership alignment but leaves a relatively narrow maintenance base.

Repo commit activity

The repository recorded no commits and no active maintainers during the last 3 months. The recent release partly offsets this, but the current maintenance pace is a meaningful caution.

Repo issue activity

There are no open issues and two open pull requests, but no issues or pull requests were merged during the last month. This gives limited evidence of ongoing responsiveness.

Token permissions

Four of five workflows omit top-level permissions, and the Dependabot auto-merge workflow grants write access. Explicit least-privilege permissions would improve workflow hygiene.