Package Health/shapecode/twig-string-loader

shapecode/twig-string-loader

It has a clear MIT license, tests, a matching repository, and organization backing. The small dependency surface and clean workflow audit help, but the single-maintainer setup and absent security policy leave limited oversight.

Latest 2.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only 3 releases since July 2019, with no release in the last 12 months and a latest release in December 2023. This indicates a materially slow maintenance cadence.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This weakens evidence of ongoing maintenance and raises abandonment risk.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not evidence of an unsafe release.

Security policy

The repository has no security policy. That leaves vulnerability-reporting and response expectations unclear, although it is not by itself evidence of poor maintenance.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, leaving avoidable build-reproducibility and action-supply-chain exposure.