tacoberu/hayo

The project has a clear README, repository tests, and frequent recent releases. One contributor made only one commit in the last three months, while all six workflow actions are unpinned. No security policy adds a smaller transparency gap.

Latest v0.3.10

Packagist

62%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All recent commit activity comes from one contributor, leaving no demonstrated backup maintainer. The repository is user-owned rather than organization-backed, so this concentration is more consequential.

Repo commit activity

Only one commit was recorded in the last three months, despite the recent release history. This is a meaningful maintenance-capacity concern, though the repository was pushed very recently.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, not evidence that the package is unsafe.

Version stability

Version v0.3.10 is not a stable major release, so the API may still change, but it is not marked as a prerelease and recent releases contain no prerelease versions.

Workflow audit

The sole workflow was fully analyzed with no untrusted checkout, injection, or high-severity findings, and it avoids broad top-level write permissions. However, all six action references are unpinned, reducing build reproducibility and supply-chain control.