yormy/xid

Clear licensing, tests, and a matching repository support straightforward maintenance. Releases and commits have stopped, while workflows use unpinned actions and install scripts run.

Latest 1.1.2

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package declares post-autoload-dump, post-install-cmd, and post-update-cmd scripts, so installation and updates execute package-defined commands. This adds operational review cost even without evidence of malicious behavior.

Release history

The package has had no release in roughly two years: its latest release was October 17, 2024, despite seven releases overall. That materially raises abandonment risk, although the package is not deprecated.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the prolonged release gap. This weakens evidence of ongoing maintenance.

Security policy

The linked repository has no security policy. That leaves vulnerability-reporting and response expectations unclear, though the repository otherwise provides tests and documentation.

Workflow audit

All 20 analyzed action references are unpinned, and one workflow grants top-level write permissions; no untrusted checkout or script-injection path was found. The audit was complete, but the workflow hygiene is still a maintenance and supply-chain caution.