PHP Open-Source Supply-Chain Review
PHP repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: PHP. 147 successful scans; 147 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| PHP | 147 | 147 | 1.60 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| PHPMailer/PHPMailer | 29.11 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 22,195 | 2026-10-31 |
| symfony/console | 18.97 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 68,113 | 2026-10-31 |
| catfan/Medoo | 16.68 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 6,852 | 2026-10-31 |
| dompdf/dompdf | 11.63 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 48,336 | 2026-10-31 |
| filamentphp/filament | 6.56 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 677,970 | 2026-10-31 |
| Respect/Validation | 6.36 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 73,005 | 2026-10-31 |
| wp-graphql/wp-graphql | 5.57 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 390,101 | 2026-10-31 |
| thephpleague/commonmark | 4.46 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 64,724 | 2026-10-31 |
| matomo-org/matomo | 4.45 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,898,921 | 2026-10-31 |
| elementor/elementor | 4.35 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,055,915 | 2026-10-31 |
| bagisto/bagisto | 3.92 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 610,816 | 2026-10-31 |
| roots/sage | 3.91 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,252 | 2026-10-31 |
| orchidsoftware/platform | 3.87 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 60,851 | 2026-10-31 |
| krayin/laravel-crm | 3.84 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 160,832 | 2026-10-31 |
| doctrine/lexer | 3.78 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,296 | 2026-10-31 |
| getgrav/grav | 3.77 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 177,058 | 2026-10-31 |
| wikimedia/mediawiki | 3.76 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,805,869 | 2026-10-31 |
| owncloud/core | 3.55 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 809,886 | 2026-10-31 |
| statamic/cms | 3.24 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 580,872 | 2026-10-31 |
| linuxserver/Heimdall | 3.12 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 33,958 | 2026-10-31 |
| mautic/mautic | 2.90 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 761,947 | 2026-10-31 |
| googleapis/google-api-php-client | 2.89 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 13,620 | 2026-10-31 |
| kimai/kimai | 2.77 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 204,772 | 2026-10-31 |
| PrestaShop/PrestaShop | 2.68 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,703,566 | 2026-10-31 |
| symfony/symfony | 2.62 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,053,323 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.