This release appears usable but warrants caution. It has a stable non-prerelease version, regular release activity over roughly 12 months, no registry deprecation, an unarchived repository, a substantial 64-file implementation, and organization-owned project backing. However, recent repository activity is minimal at two commits in three months and concentrated entirely in one contributor, while the package and repository lack README, tests, and changelog files; the repository also does not match the package name and does not provide a detectable README mention. Missing security scanning and a security policy further reduce transparency, although the workflow showed no analyzed dangerous patterns and the package has a declared GPL-3.0-or-later license. Depend on it only after reviewing its compatibility and maintenance expectations.
68%
Total Score
60
100
78
80
Only one registry account has publish access. That is not inherently concerning because the linked repository is organization-owned, but it still leaves registry publishing dependent on a narrow account base.
The artifact and repository provide no README, tests, or changelog. GitHub Releases are enabled, but the supplied signal does not show that release notes compensate for the broader documentation and testing gaps.
All two recent commits came from one contributor, creating a concentrated maintenance dependency. Organization ownership partially mitigates handoff risk, but no second active contributor is shown.
Only two commits were made in the last three months by one active maintainer, which is a limited recent maintenance pace despite the stronger release history.
There are no open issues or pull requests, no issue activity in the last month, and one merged pull request. This is compatible with a small project but offers little evidence of a broad maintenance or user-support community.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.