Clear documentation, tests, and licensing make the package easier to evaluate and integrate. The project is only six days old and all recent work comes from one person; broad workflow permissions and unpinned actions add modest maintenance risk.
65%
Total Score
75
100
88
75
The package is only 6 days old and has two releases, so its maintenance record and long-term stability are not yet established.
All 9 recent commits came from one contributor, leaving maintenance highly dependent on a single person.
Composer is used as a build tool, but no security-scanning tools were detected. This is a modest transparency and maintenance gap for a newly published package.
The repository has no security policy, so users have no documented vulnerability-reporting process.
Both workflows were analyzed without audit findings or unsafe untrusted triggers, but all 4 action references are unpinned and one workflow grants top-level write permissions. These are workflow-hardening concerns rather than severe risks on their own.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
moodle/moodle Version ^4.5 || ^5.0 | — | — |
moodle/composer-installer Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.