shivammathur/spc

The package is clearly documented, licensed, and provides release notes for this version. Its small workflow is fully audited, but the published release is old enough that pinning it requires extra maintenance caution.

Latest 0.0.5

Packagist

60%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest registry release was about four years ago, with no releases in the last 12 months. The linked repository was pushed more recently, but the registry artifact itself is stale.

Repo commit activity

There were no commits and no active maintainers in the last three months. Although the repository was pushed in 2025, the lack of recent activity weakens confidence in ongoing maintenance.

Repo tooling

Composer is used as a build tool, but no security scanning tool was detected. This is a modest repository-hygiene gap rather than evidence that the release is unsafe.

Version stability

Version 0.0.5 is not a stable major release, but it is not marked as a prerelease and recent releases have not been prerelease versions.

Workflow audit

The single workflow was analyzed successfully with no detected injection, untrusted-checkout, or other audit findings. Its one action is unpinned, which leaves a small reproducibility and supply-chain hygiene gap.