swissspidy/phpstan-no-private
The package is clearly documented, licensed, and tested in its repository, with a small dependency surface. However, nine of ten workflow actions are unpinned, and a high-confidence bot-condition finding weakens automation trust.
64%
Total Score
50
100
93
75
Health Score Breakdown
The package has had no releases in the last 12 months, and its latest release was in November 2024 despite being assessed in September 2026. This is a meaningful maintenance concern for a PHPStan extension.
There were zero commits and zero active maintainers in the last three months, which supports the concern that maintenance has slowed. The repository is not archived, but that does not compensate for absent recent activity.
Nine of ten action uses are unpinned, and the high-confidence bot-conditions finding affects the auto-merge workflow, which also has top-level write permissions. These are workflow hygiene and automation risks, but not evidence that the package itself is unfit.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 phpstan/phpstan Version ^2.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 3 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.