wexample/symfony-company

Usable with caveats: it is actively released and backed by an organization, but the repository appears to contain no concrete package code and all recent commits come from one contributor. The missing security policy and minimal repository activity make this a less transparent dependency than its release cadence suggests.

Latest 1.0.92

Packagist

62%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A README is present, but it explicitly says the repository provides no concrete code to document; tests and a changelog are absent. Missing tests and changelog are not concerns for the published artifact by themselves, but the README's description of an apparently empty package is a transparency concern.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a meaningful continuity risk if that person stops maintaining the package. Organization backing provides some capacity to hand maintenance off, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, which fits the package ecosystem, but no security-scanning tooling was detected. This reduces assurance around ongoing project hygiene.

Security policy

The repository has no security policy. That is a transparency and vulnerability-reporting gap, although it is not by itself evidence that the package is unsafe.