yab/formmaker

Maintenance is active, with 17 releases in the last year and commits from two contributors in the last three months. The workflow has broad permissions and unpinned actions, while security guidance is absent; prefer the named replacement for new projects.

Latest v7.9.1

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the whole package abandoned and names grafite/formmaker as its replacement. Active releases and recent repository activity partly compensate, but relying on the replacement is safer for new work.

Repo bus factor

One contributor made 13 of 14 recent commits, or about 93%, leaving the project dependent on a single primary contributor. Organization backing provides some handoff capacity but does not remove the concentration concern.

Repo tooling

Composer is used for builds, but no security scanning tooling was detected. The missing scanning is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policy

The repository has no security policy. This makes vulnerability reporting and response expectations less clear for a package used in applications.

Workflow audit

The single workflow was fully analyzed with no reported audit findings, but all three action references are unpinned and the workflow grants top-level write permissions. Those are avoidable supply-chain and least-privilege weaknesses without an untrusted trigger or checkout.