sokil/php-isocodes

The CI workflow leaves all seven action references unpinned, and no security policy is published. The package is clearly licensed, has repository tests and a changelog, and its source remains active rather than archived.

Latest 4.4.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are owned by the same individual account, so there is no organizational backing shown to compensate for the thin ownership base.

Release history

The package is mature, with 59 releases over more than 12 years, but it had no releases in the last year despite a historical median interval of about 30 days. That slowdown lowers confidence in ongoing maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with no registry releases in the last year, this is the clearest sign that maintenance has slowed.

Security policy

The repository has no published security policy. This is a transparency gap, though it is partly offset by the presence of Psalm-based analysis.

Workflow audit

The single workflow was fully analyzed with no injection or high-severity findings, and it has no top-level write permissions. However, all seven action references are unpinned, leaving CI exposed to upstream reference changes.