Generated and versioned meta-package wrapping Metro
82%
Total Score
100
92
100
50
No build attestation or trusted publisher provenance is available, so consumers have limited independent evidence about how the published artifact was produced. This lowers transparency, but is not by itself evidence of abandonment.
The artifact contains no README, tests, or changelog, leaving documentation and release-validation evidence thin. No repository-side compensation was collected, so this is a genuine but moderate hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
metro Version 0.84.6 | — | — |
metro-core Version 0.84.6 | — | — |
metro-cache Version 0.84.6 | — | — |
metro-config Version 0.84.6 | — | — |
metro-runtime Version 0.84.6 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.