The repository includes tests and Dependabot, but adoption is minimal and publishing rests with one person. CI uses an unpinned container image and all six action references are unpinned, so build reproducibility needs attention.
60%
Total Score
50
100
83
67
The repository is owned by an individual rather than an organization, so the single registry maintainer represents a genuinely thin project backing rather than ordinary organizational publishing hygiene.
The package is about 14 months old but has only three releases, all concentrated within roughly two days, with no releases in the last 12 months. That suggests maintenance may have stalled.
There are no new issues or merged pull requests in the last month, while two pull requests remain open. This offers limited evidence of active maintenance.
The repository has one star, no forks, and no watchers. Popularity is only supporting evidence, but these very low adoption signals provide little external confidence.
The linked repository is not archived, although its last recorded push was about 9 months ago, which is consistent with the release-history concern rather than an abandonment verdict by itself.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/http Version ^10.0 || ^11.0 || ^12.0 | — | — |
illuminate/support Version ^10.0 || ^11.0 || ^12.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.