tamodaleko/oauth2-yahoo

The package is small and clearly scoped, with a matching repository, MIT license, and only one runtime dependency. Its minimal documentation and lack of security tooling add little assurance for a dependency that has not changed since 2017.

Latest v1.0.1

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had only two releases, both in June 2017, with no releases in more than 9 years. This is strong evidence of abandonment risk for a dependency that may need compatibility updates.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with its last push in 2017. The long-standing absence of activity materially lowers maintenance confidence.

Maintainers

A single registry maintainer is reasonable for a small package, but it leaves little demonstrated maintenance capacity when combined with the absence of recent commits and releases.

Package scaffolding

The 48-character README is present, but the package and repository have no tests or changelog. Missing tests and changelog are normal packaging practice, while the very limited consumer documentation is a minor transparency gap.

Repo popularity

The repository has 0 stars and 0 forks, providing no meaningful adoption evidence to offset the lack of recent maintenance. Popularity is only supporting evidence, but here it reinforces the uncertainty.