seven.io/craft

The focused codebase is clearly tied to an organization and has a license, release notes, dependency automation, and a matching repository. Its limited adoption, absent recent commit activity, missing security policy, and workflow hygiene issue reduce confidence in long-term upkeep.

Latest v1.0.0

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only one release exists, published about 3 years ago, with no releases in the last 12 months. That is meaningful evidence of limited ongoing maintenance for a plugin dependency.

Repo commit activity

There were no commits and no active maintainers in the last 3 months. Combined with the single-release history, this indicates weak evidence of active maintenance.

Repo issue activity

There were no issues or pull requests opened or merged in the last month, while one issue and three pull requests remain open. This suggests limited recent project responsiveness.

Security policy

No security policy is present in the repository. That is a transparency gap for a plugin handling API credentials and messaging services.

Workflow audit

The sole workflow uses a pull_request_target trigger, top-level write permissions, and an unpinned action; the high-confidence bot-conditions finding adds workflow hygiene concern. No untrusted checkout or script-injection sink was found, so this is not a severe risk on its own.