ugarit/helpers

Usable with caveats: this is a newly published compatibility package with only one release, so its long-term maintenance track record is unproven. The organization-backed repository has clear licensing, tests, security reporting, and build automation, but several workflows grant write access and one uses pull-request-target.

Latest 1.00.00

Packagist

72%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

Six workflows were analyzed with no untrusted checkout or script-injection findings, but one pull-request-target workflow increases workflow review risk.

Release history

The package was first released today and has only one release, so there is no meaningful release track record yet. This is a maturity concern, though the repository’s organization backing and documentation provide some compensation.

Repo commit activity

There were no commits or active maintainers in the last three months, but the package is only one day old, so this does not yet demonstrate abandonment. It does leave future maintenance capacity unproven.

Token permissions

All workflows declare permissions, but three grant top-level write access while only three are read-only. Explicit permissions are good hygiene, though broad write access increases operational risk.