Usable with caveats: the package is actively released, licensed, tested in its repository, and backed by Alibaba Cloud. Maintenance is concentrated in one recent contributor, and the repository lacks a security policy and explicit workflow token permissions.
72%
Total Score
75
50
89
80
The package has 14 runtime dependencies, including several networking and WebSocket libraries, which increases dependency surface but is consistent with its stated client and WebSocket functionality.
One contributor made all five commits in the last three months, creating a genuine continuity risk. The repository is organization-owned, which provides some ability to hand maintenance off, but no second active contributor is shown.
There are only two open issues and one open pull request, but no issues or pull requests were opened or closed in the last month, providing limited evidence of community responsiveness.
The repository has six forks and three watchers but no recorded stars, so external adoption evidence is limited. Organization backing and active releases partly compensate for the low popularity signal.
The repository uses Composer for builds but reports no security-scanning tools, leaving automated security hygiene less visible.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ratchet/pawl Version ^0.4 | — | — |
ratchet/rfc6455 Version 0.3.0 | — | — |
alibabacloud/tea Version ^3.2 | — | — |
clue/block-react Version ^1.5 | — | — |
guzzlehttp/guzzle Version ^6.3|^7.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.