spatie/statamic-health

The source is licensed, documented, tested, and backed by an organization with matching repository references. Its registry release history is stagnant, and the package is identified as borrowing another package's identity; workflow pinning and the absent security policy add smaller concerns.

Latest 1.0.0

Packagist

38%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package is marked as borrowing the identity of spatie/image, which has far more releases and downloads; although artifact overlap is zero, this remains a serious dependency-selection risk.

Release history

Only one release exists, with no registry release since February 2022. The repository is present, but this package-level cadence leaves consumers exposed to abandonment and compatibility risk.

Repo commit activity

There were zero commits and zero active maintainers in the three months measured, which reinforces the lack of recent package maintenance despite the repository not being archived.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations unclear. Dependabot is enabled, which provides some compensating maintenance tooling but does not replace a policy.

Workflow audit

All eight action references are unpinned, and the audit found a high-confidence unpinned container image. The pull-request target workflow has no untrusted checkout or script-injection sink, limiting the impact to workflow hygiene.