ssolweb/string-morpher

This release appears healthy and suitable for dependency use: it is actively released, currently stable, non-deprecated, backed by a non-archived organization-owned repository, and has focused dependencies, tests, documentation, licensing, and safe workflow analysis. The main reservations are the absence of a security policy and security-scanning tooling, incomplete explicit token-permission declarations in most workflows, and some contributor concentration, although recent activity from two contributors and organizational backing reduce the abandonment concern. Several other health dimensions were not collected, so this assessment is not fully comprehensive.

Latest v1.1.5

Packagist

84%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a genuine supply-chain hygiene gap, though it does not by itself indicate abandonment or maliciousness.

Security policy

No repository security policy was found. This weakens vulnerability-reporting transparency and incident-response expectations, though it is a documentation gap rather than evidence that the package is unsafe.

Token permissions

Eight of nine workflows lack top-level token-permission declarations, while none declare top-level write permissions and one is explicitly read-only. The absence of explicit least-privilege declarations is a caution for CI hardening, partially offset by the lack of detected write permissions.