yegor256/phprack

The project has tests, a clear license, and a useful README. Its workflows leave all 21 actions unpinned and it has no security policy, increasing maintenance risk.

Latest 1.1

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

This package has only one release, published over 11 years ago, with no releases in the last 12 months. That is a substantial maturity and maintenance concern, although the linked repository is still active.

Repo bus factor

All recent commits came from one contributor, leaving maintenance dependent on a single active person. The repository is user-owned rather than organization-owned, so there is no shown organizational handoff to offset that concentration.

Repo commit activity

The repository recorded one commit in the last 3 months, so it is not entirely dormant, but this is very limited activity for a package whose release has not changed in over 11 years.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it is not evidence of an unsafe release by itself.

Workflow audit

All 21 analyzed action references are unpinned, which weakens build reproducibility and update control. No dangerous triggers, untrusted checkouts, script injection, or audit findings were detected, limiting this to a hygiene concern.