This is a healthy, actively maintained release with strong evidence of ongoing stewardship: 31 releases over roughly 763 days, 21 releases in the last 12 months, a stable non-prerelease version, a current non-archived repository, and an organization-owned source project. The package is licensed, has a substantial generated source tree and changelog, uses only three runtime dependencies, and has no install-time lifecycle scripts. The main concerns are that all seven recent commits came from one contributor, the repository has no tests or security scanning, and there is no security policy; low popularity is also a limited supporting concern. These are meaningful transparency and resilience gaps, but they do not outweigh the strong release cadence and active organizational backing.
78%
Total Score
90
100
83
90
A README and changelog are present and the repository uses GitHub Releases, which supports transparency; however, neither the artifact nor repository contains tests. For this generated SDK, the missing tests are a modest hygiene gap rather than a severe health risk.
One contributor made all seven commits in the last three months, creating a real continuity risk. Organization ownership provides some mitigation, but no second active contributor is shown.
The repository has zero stars and forks and only three watchers. This is weak supporting evidence, but popularity alone does not establish abandonment, especially given the active release and commit history.
Composer is used as a build tool, but no security scanning tools are present. The missing scanning reduces security-process transparency, although it does not directly demonstrate poor package maintenance.
No security policy was found, leaving vulnerability-reporting and response expectations undocumented.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
alibabacloud/darabonba Version ^1.0.0 | — | — |
alibabacloud/openapi-core Version ^1.0.10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.