The underlying project is actively developed, with 31 releases in the last year and a current stable release. Use infocyph/intermix instead, because this package is deprecated even though its linked repository remains maintained.
22%
Total Score
88
100
81
83
The entire package is marked abandoned on Packagist and has an explicit replacement, infocyph/intermix. This directly makes depending on this package inappropriate despite its recent release activity.
All 541 recent commits came from one contributor, creating a strong single-maintainer continuity risk. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.
The repository name does not match this package and its README does not mention the package name, so the link does not clearly establish that this repository publishes this package. The mismatch is especially important because the registry package is under a different namespace.
All five workflows were analyzed successfully with no audit findings, no untrusted checkouts, and job-level permissions. However, all 27 action references are unpinned, leaving workflow dependencies exposed to moving revisions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/cache Version ^3.0 | — | — |
psr/container Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.