yard/wp-block-registrar

This is a generally healthy, usable release: it is a stable major version, not deprecated, has a recent release history, a non-archived repository, clear MIT licensing, tests, a complete small source tree, and appropriate Composer and Dependabot tooling. The main concerns are limited recent maintenance capacity—only one commit from one active maintainer in the last three months—and incomplete repository security hygiene, with no security policy and most workflows lacking top-level token permissions; organization backing provides some mitigation, but these issues warrant monitoring before adopting it as a critical dependency.

Latest v2.0.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All recent commits came from one contributor with a 100% share. The organization-owned repository provides some handoff capacity, but the observed recent contributor base remains concentrated.

Repo commit activity

Only one commit was recorded in the last three months from one active maintainer, indicating thin recent maintenance activity despite the recent release and merged pull requests.

Repo popularity

The repository has only one star and no forks, indicating limited public adoption, but popularity is supporting evidence rather than a health verdict and the package has stronger direct maintenance evidence.

Security policy

No repository security policy was found, leaving vulnerability-reporting expectations less transparent for dependents.

Token permissions

Five of six workflows lack top-level permissions declarations and one workflow declares write permissions. Although no dangerous workflow was detected, this is weaker least-privilege hygiene and increases CI exposure.