spryker/step-engine

Healthy and suitable to use, with a maintenance caveat: the repository is active, well-supported by multiple contributors, and the release is documented, but no registry release has appeared for about 15 months. The missing security policy and undeclared workflow token permissions are additional transparency gaps.

Latest 3.7.0

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has been maintained since 2016 with 27 releases, but it has had no release in about 15 months. Recent repository activity provides some compensation, though the registry cadence is slower than ideal.

Repo popularity

The repository has only two stars and two forks, indicating limited public adoption, but popularity is supporting evidence and does not outweigh the stronger maintenance signals.

Repo tooling

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency gap rather than evidence that the package is unsafe or abandoned.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. The active organization-backed project and recent contributor activity partly compensate, but not fully.

Token permissions

The single analyzed workflow does not declare top-level token permissions, so its CI privileges are less explicit than recommended. No write-enabled workflow or other dangerous workflow pattern was detected.