Documentation, repository tests, and a matching source project make integration more transparent. The workflow leaves both actions unpinned, and the package has not yet built a maintenance record.
70%
Total Score
50
81
50
The package was first released today and has five releases within roughly six hours, so there is not yet evidence of sustained maintenance or release discipline.
There were no commits or active maintainers in the last three months, but the package is only hours old, so this is an absence of history rather than evidence of abandonment.
Composer build tooling is present, but no repository security scanning tool was detected, leaving a minor transparency and maintenance gap.
Version 0.4.1 is a non-prerelease 0.x release, but the early major version signals an API that may still change substantially.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but both of its action references are unpinned, reducing build reproducibility.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-client Version ^1.0 | — | — |
psr/http-factory Version ^1.0 | — | — |
illuminate/config Version ^13.0 | — | — |
illuminate/console Version ^13.0 | — | — |
illuminate/support Version ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.