Package Health/spicyweb/craft-embedded-assets

spicyweb/craft-embedded-assets

This is a mature, actively published package with more than ten years of release history, 118 releases, a current stable version, a non-archived repository, and organization backing from Spicy Web. Its main concerns are limited recent development activity—only 2 commits in the last 3 months from one contributor—and the absence of repository security scanning, a security policy, and tests. Those gaps warrant monitoring and review before adoption, but the strong release cadence, documentation, changelog, licensing, and maintained repository make it a generally reasonable dependency.

Latest 5.4.9

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has a README and changelog, and the repository also has a changelog and uses GitHub Releases. Tests are absent in both places, which is a modest transparency gap for a plugin with substantial source code.

Repo bus factor

All 2 recent commits came from one contributor, giving a 100% top-contributor share. This is a genuine continuity concern, although organization ownership provides some potential for handoff.

Repo commit activity

There were 2 commits in the last 3 months with 1 active maintainer. Recent work has not stopped, but the low volume suggests maintenance capacity may be constrained.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured. The build tooling is positive, while the missing scanning reduces supply-chain transparency.

Security policy

No repository security policy was found. This weakens vulnerability-reporting transparency, though it is a hygiene gap rather than evidence that the package is unmaintained.