socialdept/atp-testnet

This release appears healthy and reasonably safe to depend on: it is actively released, not deprecated, backed by a non-archived organization-owned repository, and has matching source, documentation, tests, CI workflows, and a clear MIT license. The main reservations are that the project is young and still on the 0.x line, recent activity is concentrated in one of two contributors, and the repository lacks a security policy, dedicated security scanning, and explicit top-level workflow token permissions. These are meaningful hygiene and continuity concerns, but they do not outweigh the strong evidence of current maintenance and coherent package provenance.

Latest v0.2.3

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Two contributors remain active, but the leading contributor made 5 of 6 recent commits, creating some continuity risk; organization backing provides partial mitigation.

Repo popularity

The repository has only 6 stars and no forks or watchers, indicating limited adoption evidence; popularity is supporting evidence, so this is a caution rather than a health verdict.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured, leaving a repository security-hygiene gap.

Security policy

The repository has no security policy, which weakens vulnerability-reporting transparency and response expectations.

Token permissions

Neither workflow declares top-level token permissions. Although no workflow requests top-level write access, explicit least-privilege permissions would provide stronger CI hardening.