simsoft/validator

This release appears generally safe to depend on from a maintenance and transparency perspective: it has a multi-year release history, five releases in the last 12 months, a stable non-prerelease version, an active non-archived repository, documented licensing, repository tests, documentation, a changelog, and no install-time lifecycle scripts. The main concerns are limited recent activity—one commit from one contributor in the last three months—and minimal repository adoption, which increase bus-factor and continuity risk. The workflow lacks explicit top-level token permissions and the repository has no detected security-scanning tool, but its analyzed workflow shows no dangerous checkout, injection, or elevated-write patterns.

Latest 4.0.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which creates publishing continuity risk; however, this is administrative access information and does not outweigh the repository's observed activity.

Project backing

The repository is owned by a personal GitHub user rather than an organization, so there is no demonstrated organizational maintenance handoff capacity to offset the concentrated contributor base.

Repo bus factor

All recent commits came from one contributor, producing a complete short-term concentration of commit activity; the user-owned repository provides no organizational backing to compensate for this concentration.

Repo commit activity

Only one commit was recorded in the last three months from one active maintainer, showing limited recent development activity and raising maintenance-continuity concerns despite the recent release history.

Repo popularity

The repository has zero stars and forks and only two watchers, so there is little external adoption evidence; this is supporting caution rather than a standalone health verdict.