sandermuller/json

Documentation, licensing, and repository activity are solid, with release notes for this version and two active contributors. Install-time scripts and a concentrated maintainer base add practical review points for a young project.

Latest v0.2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs post-install and post-update Composer scripts. These add supply-chain and reproducibility review points even though no other provided signal shows malicious behavior.

Maintainers

The registry has one publishing maintainer. The linked repository is user-owned rather than organization-owned, so there is limited visible publishing redundancy, though repository activity shows another contributor.

Project backing

The package and repository are consistently owned by the same individual, and the repository is user-owned. This supports identity consistency but provides less organizational maintenance backing.

Release history

The package is only 60 days old and has two releases, both published within roughly 5 hours, so there is limited evidence of sustained release maintenance.

Repo bus factor

Two contributors were active, but the top contributor made about 65% of recent commits. That is a modest concentration risk for a user-owned project, not a severe single-maintainer failure.