zxf/captcha

This is a usable but still immature package with clear source alignment, an MIT license, tests, a substantial README, stable releases, and no deprecation or install-time lifecycle scripts. However, it is only 158 days old, is maintained by one registry account, shows no commits or active maintainers in the last 3 months, and lacks security scanning and a security policy. The recent push and regular release cadence provide some reassurance, but the absence of recent commit activity makes long-term maintenance uncertain; depend on it with normal controls such as version pinning and monitoring.

Latest v1.0.9

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository records zero commits and zero active maintainers over the last 3 months, a significant concern for ongoing maintenance despite the recent push timestamp and frequent registry releases.

Maintainers

Only one account has registry publish access, which creates a limited publishing bus factor for this user-backed project and increases continuity risk if that maintainer becomes inactive.

Project backing

The source repository is owned by an individual user rather than an organization, so there is no demonstrated organizational backing to offset the single-maintainer risk.

Release history

Eleven releases in 158 days, including releases within the last week and a median interval of about 4 days, show active early-stage publishing. The short overall history means long-term maintenance is not yet established.

Repo issue activity

There are no open issues or pull requests and no recent issue or pull-request activity. This avoids an unresolved backlog but provides little evidence of an active maintenance community.