Package Health/trendyminds/blacksmith-cli

trendyminds/blacksmith-cli

This is a healthy, actively published release with a stable major version, 38 releases over roughly 625 days, a recent release and repository push, an organization-backed repository, matching package references, tests, a clear README, and a licensed MIT codebase. Maintenance activity is modest at two commits in the last three months, and the repository lacks a security policy, automated security scanning, and top-level workflow permissions, but the analyzed workflows show no dangerous trigger, checkout, or script-injection patterns; these are transparency and hardening gaps rather than evidence of abandonment. The package appears reasonable to depend on, with normal operational monitoring appropriate for a CLI tool.

Latest 3.2.0

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

Only two commits were recorded in the last three months, indicating modest recent development activity. The recent release and repository push, plus two active maintainers, partially offset but do not eliminate this maintenance concern.

Repo issue activity

There are no open issues or pull requests and no recent issue or pull-request activity. This is ambiguous for a small project: it provides little evidence of community engagement but does not demonstrate unresolved maintenance problems.

Repo popularity

The repository has zero stars and forks and only two watchers. This limits popularity-based supporting evidence, but popularity is not required for a small, maintained package and does not independently indicate poor health.

Repo tooling

Composer and Box provide explicit build tooling, supporting reproducible packaging, but no security-scanning tools are configured. The missing scanning is a hardening gap rather than a direct health failure.

Security policy

No repository security policy was found, reducing vulnerability-reporting transparency. This is a documentation gap, not evidence that the package is abandoned or unsafe to depend on.