The narrow dependency set and matching source repository are useful positives. However, the package has had no registry release for about six years, no recent commits, and no security policy, making maintenance uncertain.
40%
Total Score
0
100
70
75
The latest release was published in June 2020, with no releases in the last 12 months. This long period without a release is strong evidence of abandonment risk.
The repository recorded zero commits and zero active maintainers during the last three months, consistent with the stale release history and indicating limited current maintenance capacity.
The package declares post-autoload-dump and post-update-cmd scripts, so dependency installation or updates can execute package-defined actions. This adds operational exposure, though the signal does not show that the scripts are harmful.
The repository is not archived, which leaves room for future maintenance, but its last push was in March 2023 and does not offset the more recent inactivity.
The repository has no security policy, reducing transparency about how vulnerabilities should be reported. This is a meaningful hygiene gap for a package that generates application code.
We didn't find any vulnerabilities for this package.
No maintainer information available.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.