spicyweb/craft-neo

This is a healthy, mature release with a long history since 2018, 413 releases, 17 releases in the last 12 months, and a recent release, indicating active maintenance and stable delivery. The linked repository is not archived, is organization-owned, matches the package name, contains tests and a changelog, and shows two active contributors; its 393 stars and 66 forks provide supporting evidence of adoption. The main reservations are the absence of repository security scanning and a security policy, plus relatively light recent commit activity and some concentration in one contributor, although the organization backing and continued releases materially reduce abandonment risk. The package is suitable to depend on, subject to normal review of its proprietary licensing terms and runtime dependencies.

Latest 5.5.13

Packagist

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Two contributors were active in the last 3 months, but the top contributor made 75% of commits. This is a mild concentration risk, partly offset by the organization-owned repository and the second active contributor.

Repo tooling

Composer build tooling is used, but no security scanning tools are detected. The build tooling is positive, while the missing scanning reduces supply-chain transparency and warrants caution.

Security policy

The repository has no security policy. For a maintained package this is a genuine disclosure and maintenance-hygiene gap, though it is not evidence that the package is unsafe by itself.