Package Health/sfolador/ai-email-suggest

sfolador/ai-email-suggest

Usable with caveats: the package is licensed, documented, tested in its repository, and clearly backed by a matching source project. However, it has had no registry release for about 3 years 7 months and no recent repository activity, while its workflow permissions and security-policy coverage are weak.

Latest 1.0.10

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target, which can be risky because it runs with elevated repository context. No untrusted checkout or script-injection patterns were detected, limiting but not removing the workflow concern.

Project backing

The registry namespace and repository are owned by the same individual, so the package has direct project backing. This is consistent with a small open-source package, though it also leaves limited organizational redundancy.

Release history

The latest release was published about 3 years 7 months ago, and there were no releases in the last 12 months. This is a substantial maintenance concern for a package tied to a fast-moving API ecosystem.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. Combined with the old last push, this indicates current maintenance capacity is uncertain.

Repository archived

The linked repository is not archived, but its last push was about 3 years ago. The non-archived status is reassuring, while the stale repository state reinforces the maintenance concern from release history.