tillio-crm/oauth-client

This is a usable but young pre-1.0 package with encouraging maintenance and transparency signals: it has seven releases over 136 days, the latest release is current, the repository is active and unarchived, the package has a substantial README, and repository tests cover the source despite tests not being shipped in the artifact. The main concerns are that all six recent commits came from one contributor, the project has no security policy or security-scanning tooling, and the package has no changelog; its v0.1 status also indicates API maturity is not yet established. It is reasonable to evaluate for use with normal dependency pinning and review, but it is not yet a low-risk, mature dependency.

Latest v0.1.6

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository owner is the user account tillio-crm, providing identifiable project ownership but not organization-level backing or an evident maintainer handoff structure.

Repo bus factor

One contributor made all six commits in the last three months, creating a significant single-maintainer continuity risk; the repository owner is a user account rather than an organization that could visibly provide handoff capacity.

Repo issue activity

There are no open issues or pull requests and no recent issue or PR activity; this is neutral for a small project, but it also gives little evidence of community support.

Repo popularity

The repository has zero stars, forks, and watchers. This does not establish a defect for a young package, but it provides no external adoption signal to offset other maturity concerns.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured, leaving a supply-chain hygiene gap.