vaclavvanik/oauth2-token

This is a coherent, licensed, non-deprecated first release with a repository that matches the package, includes tests, changelog, CI/release workflows, a security policy, and no detected dangerous workflow patterns. However, the package is brand new with only one release and no measurable three-month commit or issue activity, so maintenance maturity is unproven; it also has a single registry maintainer, no security-scanning tooling, and incomplete GitHub Actions permission hardening. It is reasonable to evaluate for adoption, but dependents should recognize the limited operational track record and monitor future releases closely.

Latest 1.0.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

The registry has one maintainer, Václav Vaník. The repository is also owned by that individual, so the single publisher is consistent with the project backing, but it still represents limited bus-factor evidence.

Release history

Only one release exists and the package is 0 days old, so there is no release track record from which to establish maintenance continuity.

Repo commit activity

There were zero commits and zero active maintainers in the measured three-month window. Because the repository is newly created, this mainly means maintenance capacity and continuity are unproven.

Repo popularity

The repository has zero stars, forks, and watchers. For a package released 0 days ago this is weak evidence rather than a standalone health failure, but it provides no external adoption signal.

Repo tooling

The repository uses Make and Composer build tooling, but no security-scanning tools were detected. The missing scanning is a genuine transparency and maintenance gap, though it is not by itself severe.