yiirocks/voyti-2fa-email

This is a young but currently well-structured and actively maintained release. The package has a clear BSD-3-Clause license, a matching source repository with documentation, changelog, repository tests, build tooling, Dependabot scanning, security policy, and no deprecation or archival indicators. The main adoption risks are its short 13-day history, zero observed popularity, and complete concentration of recent commits in one contributor, although organization ownership and very recent activity partly mitigate the bus-factor concern. The workflows also omit top-level token permissions, which is a repository hygiene weakness, but no dangerous workflow patterns were detected.

Latest 1.0.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is only 13 days old with three releases and a median interval of about 6.6 days, so it has limited demonstrated maintenance history despite recent release activity.

Repo bus factor

One contributor made all seven recent commits, creating a real concentration risk. Organization ownership partly compensates because maintenance can potentially be handed off, but no second active contributor is shown.

Repo popularity

The repository has zero stars and forks and one watcher. This provides little external validation, although low popularity is not by itself evidence of poor health for a young, specialized extension.

Token permissions

Both workflows lack top-level token permission declarations. No workflow requests top-level write access, but explicitly setting least-privilege permissions would improve CI security hygiene.