utopia-php/dns

utopia-php/dns 3.0.7 appears healthy and reasonable to depend on: it is actively released, on a stable major version, backed by a non-archived organization-owned repository, and supported by six active contributors with balanced commit participation. The package is licensed, tested, clearly documented, and has no install-time lifecycle scripts. The main reservations are low repository popularity, no security policy or security-scanning tooling, and a mirror workflow using pull_request_target with write permissions; these are supply-chain hygiene concerns, but they do not outweigh the strong maintenance and project-backing evidence.

Latest 3.0.7

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

The single analyzed workflow uses pull_request_target, which can expose privileged workflow execution to pull-request event handling. No untrusted checkout or script injection was detected, so this is a contained but meaningful workflow-risk concern.

Repo issue activity

There is one open issue and two open pull requests, with no issues or pull requests opened or merged in the last month. This suggests limited recent community workflow activity, although commit activity remains active.

Repo popularity

The repository has only 8 stars, 0 forks, and 5 watchers. This is weak supporting evidence, though popularity alone is not decisive and the active contributor and release signals are stronger.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a genuine repository hygiene gap, not evidence that the package is malicious.

Security policy

No repository security policy was found, reducing transparency around vulnerability reporting and response procedures.