yiirocks/voyti-2fa

This release appears reasonably safe to depend on from a maintenance and transparency perspective: it is a stable, non-deprecated 1.0.3 release with a matching repository, license files, changelog, repository tests, active recent commits, build tooling, dependency scanning, and a security policy. The main concerns are that the package is only 13 days old, all 15 recent commits come from one contributor, repository popularity is currently negligible, and both workflows omit top-level token permissions. The organization-owned repository provides some mitigation for the concentrated maintainer base, but the package remains relatively immature and should be monitored before becoming a deeply embedded dependency.

Latest 1.0.3

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is very new at 13 days old, although four releases with a median interval of about 3 days show active early development. The short history limits confidence in long-term maturity.

Repo bus factor

One contributor accounts for all 15 commits in the last 3 months, creating a real continuity risk. Organization ownership partly compensates because maintenance can potentially be handed off within the organization.

Repo popularity

The repository has zero stars and forks and one watcher, so there is little external adoption evidence. Popularity is supporting evidence rather than a decisive health verdict, especially for a package only 13 days old.

Token permissions

Neither of the two workflows declares top-level token permissions, leaving least-privilege configuration less explicit than desirable. No workflow has top-level write permissions, which limits the severity of this hygiene gap.