wpjscc/react-stream-json

The repository has tests, a stable release, and an MIT license. Maintenance evidence is limited, while workflow permissions and unpinned actions add avoidable hygiene concerns. The package is a reasonable trial dependency but warrants ownership and update checks.

Latest v1.0.0

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only one release, published about 2 years and 3 months ago, with no releases in the last 12 months. That limits evidence of continued maintenance.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Combined with the single-release history, this is meaningful evidence of limited recent maintenance.

Repo tooling

The repository uses Make and Composer build tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency and maintenance gap.

Security policy

No security policy was found in the repository, leaving vulnerability-reporting expectations undocumented.

Workflow audit

Both workflows grant top-level write permissions and all 2 analyzed action references are unpinned, creating avoidable CI supply-chain and permission hygiene risks. No untrusted checkouts, script injection, or audit findings were detected, so this is not a severe workflow risk.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Cees-Jan Kiewiet

Direct Dependencies

Dependency	Last Release	Score
react/stream Version ^1.3.0	—	—
react/promise Version ^3 \|\| ^2.3 \|\| ^1.2.1	—	—
reactivex/rxphp Version ^2.0.11	—	—
evenement/evenement Version ^3.0.2	—	—
thecodingmachine/safe Version ^2.5	—	—