useburrow/craft-burrow

This is a relatively young but actively maintained Craft CMS plugin with 30 releases over 168 days, a stable current major version, a non-deprecated registry status, and a recently updated repository. The organization-owned repository matches the package and references it in its README, and two contributors have been active recently, although 84% of the last three months' commits came from one contributor. The package has a clear README, changelog, license file, and conventional Composer build setup, but it lacks tests, repository security scanning, and a security policy. Overall, it appears usable to depend on, with moderate maintenance and transparency risks that warrant normal due diligence for a package handling integrations and operational data.

Latest 5.5.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has a substantial README of 9,461 characters and a changelog, while neither the package nor repository contains tests. Documentation and release notes are positive, but the absence of tests is a genuine quality and maintenance gap for an integration-heavy plugin.

Repo bus factor

Two contributors were active, but the leading contributor made 84% of recent commits. The second contributor provides some redundancy, while the organization backing reduces the risk of total single-person dependence; concentration remains a moderate caution.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. This is not inherently negative for a young, actively released project, but it provides little evidence of public maintenance interaction.

Repo popularity

The repository has zero stars, forks, and watchers. This limits external validation and adoption evidence, but popularity is supporting evidence and the package has direct activity signals, so this is only a mild concern.

Repo tooling

Composer is used as a build tool, but no security scanning tools were detected. The conventional build setup is positive, while the missing automated security tooling leaves a transparency and assurance gap.