The package includes a substantial README and tests, and the repository is maintained by an organization rather than an individual. The proprietary license and thin recent activity make long-term adoption and reuse less predictable.
62%
Total Score
63
50
71
75
The manifest declares a proprietary license, with no detected license text or license file in the package or repository. This materially limits redistribution and creates a significant adoption concern despite the available source.
The release declares 9 runtime dependencies, including established framework and HTTP components. This is a meaningful dependency surface but not unusually large for a Salesforce SDK.
The package has existed for about 8 years with 39 releases, but only 1 release in the last 12 months. This indicates a mature history with limited recent release cadence.
All recent commits came from one contributor, creating concentrated maintenance responsibility. Organization ownership provides some handoff capacity, so this is a caution rather than a severe risk.
Only 1 commit was recorded in the last 3 months, indicating very light recent development activity even though it aligns with the latest release.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.1 | — | — |
ramsey/uuid Version ^3.8 | — | — |
jms/metadata Version ^1.0|^2.0 | — | — |
symfony/cache Version ^4.0|^5.0 | — | — |
jms/serializer Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.