utopia-php/auth

This is a well-supported, actively maintained release with strong repository activity, frequent releases, seven active contributors, clear MIT licensing, extensive tests and documentation, and no deprecation or archival concerns. The organization-backed project provides useful maintenance capacity despite a single registry maintainer account. The main reservations are the pre-1.0 version, absence of a security policy and security-scanning tooling, and a workflow using pull_request_target with write permissions; these warrant review of the CI configuration but do not outweigh the package’s otherwise strong health evidence.

Latest 0.12.0

Packagist

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

The sole workflow uses pull_request_target, which can be security-sensitive even though no untrusted checkout or script injection was detected; this warrants CI review.

Repo popularity

The repository has modest popularity with 3 stars, 1 fork, and 1 watcher. This is weak supporting evidence, but popularity is not decisive and the activity signals are strong.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a hygiene gap for an authentication package, though it is not by itself evidence of abandonment.

Security policy

No repository security policy was found. For an authentication and token-handling library, this is a meaningful transparency and vulnerability-reporting gap.

Token permissions

The workflow has top-level write permissions, increasing the potential impact of a CI compromise; this is a concrete permissions-hygiene concern despite the absence of other detected workflow hazards.