The package has clear documentation, an MIT license, stable releases, and organizational backing. Maintenance has slowed sharply, and all four workflow actions are unpinned; Dependabot provides some compensating upkeep.
67%
Total Score
67
100
94
75
The package has 36 releases over about 2 years and a typical release interval of about 8 days, but it has had no releases in the last 12 months. That recent silence lowers confidence in ongoing maintenance despite its strong historical cadence.
The repository recorded zero commits and zero active maintainers in the last 3 months. Combined with no registry releases in the last 12 months, this is a meaningful maintenance concern.
There are no new or closed issues in the last month, and two pull requests remain open. This indicates limited recent interaction, though the open pull requests show some pending project activity.
The repository has no security policy. For a small developer-tool configuration package this is a transparency gap, although it is not evidence of unsafe behavior by itself.
The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 action references are unpinned, which leaves workflow builds exposed to moving action revisions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
friendsofphp/php-cs-fixer Version 3.86.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.