spryker-demo/pdf

It has a clear license, a usable README, and a matching organization-owned repository. The dependency set is modest and installation has no lifecycle scripts, but consumers should pin this exact release rather than expect active updates.

Latest 1.0.0

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

This is the only release, published about 16 months ago, with no releases in the last 12 months. The repository is still present, but the registry history provides little evidence of ongoing maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months. That is meaningful maintenance evidence against the package, even though it is not archived.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow audit

The sole workflow was fully analyzed with no audit findings or untrusted-trigger sinks. However, all four action references are unpinned, which weakens build reproducibility and supply-chain hygiene.