Package Health/symplify/easy-coding-standard

symplify/easy-coding-standard

This is a mature, actively released, stable, non-deprecated MIT package with a substantial source tree, repository tests and changelog, recent release activity, and a current non-archived organization-owned repository. The main concern is concentration risk: all 84 commits in the last 3 months came from one contributor, while the repository has no security policy or dedicated security scanning and its workflows do not declare top-level permissions. These are meaningful transparency and resilience gaps, but they are outweighed by the package's long history, frequent releases, clean workflow-risk analysis, build tooling, tests, and active project backing.

Latest 13.3.2

Packagist

86%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the recent commits, creating a genuine bus-factor and continuity risk. Organization ownership provides some capacity for handoff, but no second recent contributor is shown by this signal.

Repo commit activity

The repository recorded 84 commits in the last 3 months, showing strong recent activity, but all were made by one active maintainer. The activity is healthy while the concentration limits resilience.

Repo tooling

Composer build tooling is present, supporting reproducible project workflows, but no security scanning tools were detected. The missing scanning is a security-hygiene gap, though it is not evidence of abandonment by itself.

Security policy

The repository has no security policy. This weakens vulnerability disclosure transparency and is a genuine hygiene gap, although it does not by itself indicate that the package is unsafe to depend on.

Token permissions

Both workflows omit top-level token permissions declarations. No workflow declares top-level write access, which limits the severity, but explicit least-privilege configuration would provide stronger CI security assurance.