seiger/scommerce

Healthy and actively maintained, with strong release and commit activity and a clear repository match. Review the install script and workflow permissions before adopting, and note the small maintainer base and lack of a security policy.

Latest v1.3.11

Packagist

78%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs a post-autoload-dump install-time script. This adds install complexity and should be reviewed, although the signal does not show a destructive or clearly unsafe action.

Project backing

The package and repository are owned by the same named individual, but the repository owner is a user rather than an organization. This supports clear ownership while offering less institutional continuity.

Repo bus factor

The top contributor made 72% of recent commits, creating some concentration risk, but two other contributors were active and one supplied 26% of commits. This is a maintenance concern rather than a severe single-person failure risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a transparency gap for a package handling e-commerce functionality, though it is not evidence of maliciousness.

Security policy

No repository security policy was found. This makes vulnerability reporting and maintenance expectations less transparent.