webchemistry/emails

This release appears generally suitable to depend on: it has a stable 1.2.7 version, 20 releases over 459 days with 17 in the last 12 months, no registry deprecation, an active non-archived repository, repository tests, and recent commit activity. The main concerns are that all 16 commits in the last three months came from one contributor, the repository has no security policy or dedicated security-scanning tooling, and workflow token permissions are not explicitly declared; these are meaningful transparency and resilience gaps, though the organization-owned repository and active release cadence provide some mitigation. Low popularity is weak supporting evidence rather than a decisive concern.

Latest 1.2.7

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 16 commits in the last three months, giving the project a top-contributor share of 100%. The organization-owned repository provides some handoff potential, but the observed contributor concentration remains a resilience concern.

Repo popularity

The repository has zero stars and forks and one watcher. Popularity is only supporting evidence, so these low counters modestly reduce external validation but do not by themselves indicate poor package health.

Repo tooling

The repository uses Composer build tooling, but no security-scanning tools are detected. The build setup is appropriate, while the missing security automation is a hygiene gap.

Security policy

The repository has no security policy. This weakens vulnerability-reporting transparency and raises a maintenance-process concern, although it is not evidence that the package is unsafe.

Token permissions

All three workflows lack top-level token-permission declarations. No workflow has top-level write permissions, which limits the observed risk, but explicit least-privilege configuration would provide stronger supply-chain hygiene.