zero-to-prod/transformable
The package has a clear README, MIT licensing, repository tests, automated release notes, and Composer tooling. Its single-person ownership and permissive workflow settings leave less maintenance and build-control redundancy.
58%
Total Score
50
86
67
Health Score Breakdown
Five workflows were analyzed with no pull-request-target, workflow-run, or untrusted-checkout risks, but one workflow contains a detected script-injection pattern that warrants caution.
One registry publishing account is a narrow operational base. The linked repository is user-owned rather than organization-owned, so there is no provided backing signal to offset that concentration.
The package has 10 releases since September 2024, but none in the last 12 months; the latest release was over a year ago, which weakens confidence in ongoing maintenance.
The repository recorded no commits and no active maintainers in the last 3 months, indicating currently dormant development despite the repository not being archived.
The repository has 1 star, 1 fork, and 1 watcher. This is supporting evidence of a small user base, but popularity alone does not make a stable small package unhealthy.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 David Smith |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 zero-to-prod/package-helper Version ^1.1.3 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 2 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.