82%
Total Score
healthy
Active maintenance and reproducible publishing outweigh workflow, security-policy, and ownership-hygiene concerns.
Five accounts can publish, with two using the the-guild.dev domain and three using Gmail addresses: ardatan, kamilkisiela, and urigo. The outside-domain accounts are an account-hygiene caution, though they do not by themselves show weak maintenance capacity.
The linked repository is owned by a user account rather than an organization, so the repository does not provide explicit organization-level succession backing.
One contributor made about 64% of recent commits, but a second contributor made about 33% and five maintainers were active, so concentration is a moderate rather than severe concern.
The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository ownership; the package is plausibly a sub-package of the linked monorepo, which partly reduces that concern.
The repository has no security policy file, leaving disclosure guidance and supported security-reporting expectations unspecified.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
tslib Version ^2.8.0 | — | — |
auto-bind Version ^5.0.0 | — | — |
graphql-tag Version ^2.11.0 | — | — |
parse-filepath Version ^1.0.2 | — | — |
change-case-all Version ^2.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.