snordian/h5p-extractor

This release is usable but carries meaningful maintenance and maturity concerns. The repository is not archived, the package is not deprecated, it has had five releases over the past 12 months, and it has a clear MIT license and a repository README that references the package. However, the project explicitly describes itself as a proof of concept, lacks tests and a changelog in both the artifact and repository, has only two commits in the last three months from one contributor, and has no security policy or security-scanning tooling. The package is therefore a reasonable dependency only if its limited maturity and concentrated maintenance capacity are acceptable and the integration is validated carefully.

Latest 0.5.4

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package runs a post-autoload-dump install-time lifecycle script. This adds installation complexity and execution surface, although the signal does not establish that the script is unsafe.

Maintainers

Only one registry account has publishing access. This is a genuine continuity concern for a user-owned project, though publishing access alone does not measure actual development activity.

Package scaffolding

A 4,509-character README provides usage guidance, but the artifact and repository contain neither tests nor a changelog. The README also calls the project a proof of concept and says the quick start is still to be completed, which materially lowers maturity and transparency.

Project backing

The repository is owned by the user account otacke, not an organization. The single-owner context makes the concentrated contributor and registry-maintainer signals more consequential.

Repo bus factor

One contributor made all two commits in the last three months, giving a 100% top-contributor share. Because the repository is user-owned rather than organization-owned, there is no project-backing evidence to offset this concentration.