The project has recent activity but all recent commits come from one person, and the linked repository does not clearly identify this package. Licensing is absent, and all six workflow actions are unpinned, increasing maintenance and build-reproducibility concerns.
58%
Total Score
67
69
75
Neither the package nor the repository provides a declared or detected license file, leaving the release without clear reuse terms.
The artifact has no README, tests, or changelog. Missing tests and changelog are normal for published artifacts, but a missing README is a minor consumer-documentation gap for this integration library.
The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.
One maintainer made all 13 commits in the last 3 months, leaving maintenance highly dependent on a single person with no observed handoff capacity.
The repository name does not match the package name, and the README package mention could not be confirmed, so the package-to-source relationship is less transparent; the mismatch could also reflect a subproject layout.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-core Version ^12.4 || ^13.4 | — | — |
typo3/cms-extbase Version ^12.4 || ^13.4 | — | — |
open-telemetry/api Version ^1.7 | — | — |
open-telemetry/sdk Version ^1.10 | — | — |
typo3/cms-frontend Version ^12.4 || ^13.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.