spatie/piper

Security scanning and release notes support a maintained project, with two active contributors and organizational backing. The repository lacks a security policy, and all 12 workflow actions are unpinned; the name resemblance to spatie/image also warrants checking the intended package.

Latest 1.1.0

Packagist

76%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

spatie/piper resembles the much more established spatie/image and the signal says it borrows that identity, so consumers should verify they intended piper rather than spatie/image. The zero artifact overlap limits the evidence that it is actually a copy.

Security policy

The repository has no security policy. That is a transparency gap for reporting and handling vulnerabilities, though the available tooling and project backing provide some compensation.

Workflow audit

All 12 analyzed action references are unpinned, which weakens build reproducibility. Three workflows grant top-level write permissions, but the audit found no untrusted checkout, script injection, or high-severity findings, so this remains a hygiene caution rather than a severe risk.