shopwell/platform

The package is well documented and backed by an organization, with tests, a changelog, and security scanning. Its newly published release has no observed commit activity, while workflow auditing found high-confidence injection, secret-scope, and artifact-credential issues that should be fixed before adoption.

Latest v6.7.0.0

Packagist

48%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Workflow audit

The audit covered only 30 of 56 workflows and found high-confidence template-injection issues, artifact checkout credentials, unpinned images, and overprovisioned secrets; several affected workflows use pull_request_target or release automation. The incomplete coverage and exposed release credentials make this a material supply-chain hygiene concern.

Dependency profile

The package declares 131 runtime dependencies, creating a broad dependency surface and more upgrade and compatibility exposure than a small focused package.

License

The release declares Apache-2.0 and includes license files, so it is licensed; however, artifact detection found MIT text, creating a license mismatch that needs clarification.

Lifecycle scripts

The package runs post-install and post-update Composer scripts, increasing installation complexity and the code executed during dependency operations.

Release history

This is the first recorded release, published on the same day as collection, so there is no demonstrated release cadence or history to support maturity.