sandermuller/repo-init

Clear documentation, tests, and release notes make the package straightforward to evaluate and maintain. Its small audience and single registry publisher limit independent validation, but recent project activity and security tooling offset that concern.

Latest 1.16.0

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Lifecycle scripts

Composer post-install and post-update scripts run during dependency operations. This is a modest supply-chain and installation-behavior concern because those scripts execute automatically, although no severe behavior is shown here.

Maintainers

Only one account has registry publishing access. That is a narrow publishing control base, but the repository shows two active contributors and the owner is actively releasing.

Project backing

The package and repository are owned by the same individual account rather than an organization. This limits institutional backing, although recent commits and releases show active personal maintenance.

Workflow audit

All six workflows were analyzed with no untrusted checkout or script-injection findings, and four use read-only permissions. However, all 27 action references are unpinned, one workflow has top-level write permissions, and a high-confidence low-severity audit found an ad hoc package installation; these are workflow hygiene cautions, not standalone severe risks.