Documentation, tests, release notes, licensing, and a security policy provide useful project structure. The repository is not archived and has no install-time scripts, but the very short history and limited observed activity leave maintenance maturity unproven; workflow references are also unpinned.
68%
Total Score
50
94
83
The package is only 0 days old with 2 releases, so there is not enough history to establish durable maintenance or release reliability.
The repository reports 0 commits and 0 active maintainers in the last 3 months. Because the package is newly published, this is partly explained by the short observation window, but it still leaves ongoing maintenance unproven.
Both workflows were analyzed with no detected injection or high-confidence audit findings, but all 3 action references are unpinned and the release workflow grants top-level write permissions. These are workflow hygiene and least-privilege concerns, not severe risks by themselves.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/psr7 Version ^1.7 || ^2.0 | — | — |
guzzlehttp/guzzle Version ^7.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.