The source repository is active and well documented, with a clear license and release notes. However, the package is maintained by one recent contributor, lacks a security policy, and should be replaced by the listed successor.
38%
Total Score
67
75
75
Packagist marks the entire package abandoned and names 2amigos/qrcode-library as its replacement. This is a direct warning against starting a new dependency on this package.
All 3 recent commits came from one contributor, giving the repository a concentrated recent bus factor. Organization backing provides some handoff capacity, but no second recent contributor is shown.
The repository had 3 commits in the last 3 months, so activity has not vanished. The modest volume still indicates limited recent maintenance capacity.
The repository name does not match this package and its README does not mention the package name, creating uncertainty about whether it is the exact package source rather than a related or replacement project. The shared organization and QR-code library context reduce, but do not remove, that concern.
Composer is used for builds, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence that the release is unsafe.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
bacon/bacon-qr-code Version ^3.0 | — | — |
khanamiryan/qrcode-detector-decoder Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.