sha443/bml-connect

Its README gives only installation guidance and says usage is still coming; there are no tests or security scanning. The MIT license, matching repository, and lack of install scripts are positives, but they do not offset the long inactivity.

Latest 1.05

Packagist

38%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The nine releases were concentrated around the initial publication in July 2021, with no releases in roughly five years. This is strong evidence of abandonment for a package handling an API integration.

Repo commit activity

The repository has recorded zero commits and zero active maintainers in the last three months, consistent with the last push being about five years ago. No provided signal shows renewed maintenance.

Package scaffolding

The package includes a short README, but it explicitly says usage is still coming; the absence of tests and a changelog is normal for published artifacts and is not penalized on its own.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. That reduces ongoing assurance, with no compensating security process shown.

Security policy

The linked repository has no security policy. This is a transparency gap for a package that connects to a payment API, although it is secondary to the inactivity evidence.