shadowfiend/whisper

This is a usable but very young package with solid basic transparency: it has an MIT license, README, tests, a coherent 28-file source tree, no install-time lifecycle scripts, a linked non-archived repository, and a read-only CI workflow. However, it has only two releases over about 30 days, remains below 1.0, and shows no commits or active maintainers in the last three months, so maintenance maturity is not yet demonstrated. Zero repository popularity, absent security scanning and security policy, and a single-user project owner add moderate uncertainty, though none is by itself evidence that the package is unsafe or unfit.

Latest v0.1.1

Packagist

64%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health checks

Project backing

The repository is owned by an individual user rather than an organization, so there is no organizational backing signal to compensate for the package's otherwise thin maintenance history.

Release history

The package is only 30 days old with two releases and a roughly 31-day median release interval, so there is not enough history to establish sustained maintenance.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. Given the package's 30-day age, this leaves ongoing maintenance capacity unproven and is a meaningful abandonment risk.

Repo popularity

The repository has zero stars, forks, and watchers. Because the package is only about 30 days old, this is supporting caution about adoption and external visibility rather than a decisive health failure.

Repo tooling

The repository uses Make and Composer build tooling, but no security-scanning tools were detected, leaving a security-process gap.