stolt/package-analyser

The repository includes tests, a changelog, and a matching README, while the MIT license and small dependency set aid review. Its single maintainer and long release pause warrant checking alternatives before adoption.

Latest v1.5.1

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry publishing maintainer is listed, which creates a thin publishing base. This is a modest concern rather than a severe risk because the linked repository and its history are available for review.

Release history

The package has 15 releases since May 2024, but none in the last 12 months and the latest was about 18 months ago. That long pause is a meaningful maintenance concern despite the earlier release cadence.

Repo commit activity

The repository recorded no commits and no active maintainers in the last 3 months. This supports the concern that development has slowed, although the repository was pushed more recently than the latest registry release.

Security policy

The repository has no security policy, which reduces transparency for reporting vulnerabilities. This is a maintenance and process gap, not evidence that the package is unsafe.

Workflow audit

All three workflows were analyzed with no untrusted checkouts, script injection, or audit findings, but all 7 action references are unpinned. The absence of a top-level permissions block is acceptable here, while unpinned actions remain a supply-chain hygiene gap.