Package Health/thelia/virtual-product-control-module

thelia/virtual-product-control-module

Its dependency footprint is minimal, installation has no lifecycle scripts, and the project is backed by an organization. The license text conflicts with the declared license, while testing, security policy, and workflow pinning remain limited.

Latest 3.0.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

License

The artifact contains a recognized GPL-3.0 license file, but the manifest declares LGPL-3.0+, so consumers should resolve the licensing mismatch before adoption.

Package scaffolding

The package has no README, tests, or changelog, but it does have a GitHub release for this exact version and the repository uses GitHub releases. The missing package tests and changelog are normal for published artifacts.

Repo bus factor

One contributor made 100% of the single recent commit, leaving no demonstrated second contributor to share maintenance. Organizational ownership provides some handoff capacity but does not remove the current concentration risk.

Repo commit activity

Only one commit was recorded in the last three months, showing limited recent development activity despite the recent release. This is a maintenance concern, but not evidence of abandonment by itself.

Repo tooling

Composer is used for builds, but no security scanning tool is configured. This weakens automated supply-chain and dependency hygiene.