tempest/command-bus

This release appears healthy and suitable for dependency use: it is actively and frequently released, stable, not deprecated, backed by a non-archived organization-owned repository, and includes a clear MIT license. The repository contains tests and shows recent activity from four contributors, although commit ownership is highly concentrated in one contributor, the repository has no security scanning or security policy, and the linked repository does not clearly mention the package in its README. These are meaningful transparency and resilience concerns, but they do not outweigh the strong release and maintenance evidence.

Latest v3.19.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

Four contributors were active, but one contributor made 45 of 49 commits, a 91.8% share. Organization ownership provides some handoff capacity, yet the observed activity remains highly concentrated and creates contributor-resilience risk.

Repo package mention

The repository name does not match the package name, and no README package mention was available. Because the repository URL is otherwise package-specific, this is a transparency concern rather than conclusive evidence of repository misassociation.

Repo popularity

The repository has zero stars and forks and one watcher. This is weak supporting evidence, but popularity is not decisive and is outweighed by the observed release and commit activity.

Repo tooling

Composer build tooling is present, but no security scanning tools are detected. The build setup is adequate, while the missing security automation is a modest transparency and hygiene gap.

Security policy

The repository has no security policy. This is a genuine disclosure-process gap, although it is not evidence that the package is unsafe or abandoned on its own.