It has tests, recent releases, and an active organization-owned repository, with no install scripts or high-severity workflow findings. The registry marks this package abandoned and names a replacement, so pinning the replacement is safer.
20%
Total Score
67
81
67
The package is marked abandoned at the registry with replacement package achd-oeaw/arche-lib. Package-level abandonment is a severe adoption concern even though other signals show recent maintenance.
All 2 recent commits came from one contributor, giving the project a concentrated recent maintenance base. Organization ownership provides some handoff capacity, but no second recent contributor is shown.
The repository had 2 commits in the last 3 months, so maintenance is present but limited in volume.
Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.
The repository has no security policy, reducing clarity about vulnerability reporting and response.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2 | ^3 | — | — |
composer/semver Version ^3.4 | — | — |
guzzlehttp/guzzle Version ^7 | — | — |
zozlak/query-part Version ^2.2 | — | — |
sweetrdf/quick-rdf Version ^2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.