spatie/ssl-certificate

The project has clear ownership, a matching repository, tests, release notes, and a current stable release. However, the package identity signal strongly suggests it borrows another package's identity, making adoption risky despite otherwise solid maintenance evidence.

Latest 2.7.0

Packagist

45%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The signal marks this package as borrowing the identity of spatie/backtrace, with explicit identity borrowing despite zero artifact overlap and no README claim of being a fork. Consumers may have intended the lookalike package instead.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months, which is a maintenance concern, although the package had a release during the assessed period.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policy

The repository has no published security policy, reducing transparency about vulnerability reporting and response.

Workflow audit

All four workflows were analyzed with no audit findings or untrusted checkouts, but all 11 action references are unpinned and one workflow grants top-level write permissions. These are meaningful workflow hygiene concerns without evidence of an active exploit path.