Usable with caveats: the repository is active, documented, tested, and not archived or deprecated, but this is a young beta release maintained by one contributor. Review updates carefully before production adoption, especially because maintenance depends on a single person.
68%
Total Score
67
88
70
The package runs a post-autoload-dump installation script. This can be legitimate package setup behavior, but it adds install-time execution that consumers should review before adoption.
The package and repository are owned by matching individual accounts, which supports provenance but does not provide the continuity of an organization-backed project.
The package is only 48 days old with three releases, but its median release interval is about 2 days, showing active early development rather than abandonment. Its short history limits maturity evidence.
All 16 recent commits came from one contributor, so maintenance and review capacity are concentrated in a single person. The repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset this risk.
The repository has no SECURITY.md or other declared security policy, leaving vulnerability reporting and disclosure expectations unclear.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/process Version ^7.0.3 || ^8.0.5 | — | — |
illuminate/console Version ^11.0 || ^12.0 || ^13.0 | — | — |
illuminate/database Version ^11.0 || ^12.0 || ^13.0 | — | — |
illuminate/contracts Version ^11.0 || ^12.0 || ^13.0 | — | — |
illuminate/filesystem Version ^11.0 || ^12.0 || ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.