seiger/slang

This is a generally healthy, actively maintained release with a clear license, stable versioning, regular recent releases, an active non-archived repository, repository tests, and a package/repository identity match. The main reservations are that publishing access is concentrated in one registry maintainer, the package uses a post-autoload-dump lifecycle script, the repository lacks security-scanning tooling and a security policy, and one workflow grants top-level write permissions. These are meaningful transparency and operational-hygiene gaps, but they do not outweigh the strong recent release and repository activity or indicate abandonment.

Latest v1.1.3

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

A post-autoload-dump install-time script increases supply-chain and installation complexity, so consumers should review what it executes before adoption.

Maintainers

Only one account has registry publishing access. This is a real publishing-continuity concern for a user-owned project, although repository activity shows that the project is currently maintained.

Project backing

The repository is owned by a user account rather than an organization, so there is no organizational maintenance buffer to offset the concentrated registry and repository ownership.

Repo bus factor

Two contributors were active recently, with the leading contributor responsible for about two-thirds of commits. This is somewhat concentrated, but the second active contributor provides partial resilience.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer reduces assurance around dependency and release hygiene.