statamic-addon/tabs

This is a young but actively maintained release: it has 11 releases over 104 days, a stable v1.0.10 version, a recent repository push, and 14 commits from three contributors in the last three months. The main concerns are weak project transparency and hygiene: neither the artifact nor repository contains a README, tests, or changelog, the repository does not clearly match or mention the package, and there is no security policy or security scanning. The package is not deprecated or archived, has a simple runtime dependency profile, and uses no install-time lifecycle scripts, so it appears usable but warrants review of its provenance and ongoing maintenance before becoming a critical dependency.

Latest v1.0.10

Packagist

72%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

Neither the artifact nor the repository has a README, tests, or changelog. Because the repository also lacks these compensating materials, documentation, verification, and release-transparency gaps remain a real concern.

Repo package mention

The repository name does not match the package name, and no README package mention was available. Without corroborating repository identity evidence, the source linkage deserves verification before relying on the package.

Repo tooling

The repository uses Composer, but no security scanning tools were detected. Build support is present, while the lack of automated security tooling is a transparency and maintenance gap.

Security policy

No security policy was found in the repository. For a package intended as a dependency, this weakens vulnerability-reporting transparency, although it is not evidence of abandonment on its own.

Token permissions

The single workflow lacks top-level permissions and uses job-level permissions only; it does not declare top-level write access. This is less concerning than broad write permissions, but the permission posture is not fully explicit.