The package is clearly documented, licensed, tested, and regularly released. Maintenance is currently concentrated in one contributor, with limited repository visibility and no documented security process.
72%
Total Score
50
100
89
83
The repository is owned by an individual user rather than an organization, so the concentrated contributor activity is not compensated by visible organizational backing.
One contributor made all observed commits in the last 3 months, leaving no demonstrated backup maintainer for this user-owned project.
Only one commit was recorded in the last 3 months. Recent publishing partly compensates for the small amount of observed source activity, but the maintenance signal is thin.
The repository has zero stars and forks and only one watcher. Popularity is not decisive for a niche library, but this provides little external evidence of review or adoption.
Composer is used for the build, but no security-scanning tools are configured. The build tooling is appropriate, while the lack of scanning modestly reduces transparency.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
alcamo/uri Version ^0.2 | — | — |
alcamo/rdfa Version 0.13 - 0.15 | — | — |
alcamo/xml-creation Version ^0.9 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.