It also lacks a license and the linked repository does not identify or mention this package. The small dependency surface and absence of install scripts reduce exposure, but not the abandonment risk.
18%
Total Score
0
100
40
75
The package has only one release, published on December 25, 2012, with no releases in the last 12 months. This is strong evidence that development has stopped.
The repository shows zero commits and zero active maintainers in the last three months, with its last push on December 25, 2012. This strongly supports the abandonment concern.
No declared license or license file was found. That creates a real legal and adoption concern for a package intended to be reused.
The repository name does not match the package name and its README does not mention the package. This raises uncertainty about whether the linked repository actually supports this release.
The repository has one star and two forks, providing little evidence of a broad user or maintainer community. Low popularity is supporting evidence rather than a verdict by itself.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ailove-dev/vk-bundle Version dev-master | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.