The package is documented, tested in its repository, licensed, and has a recent release supporting Laravel 13. Maintenance has gone quiet for three months, while the automated workflows have a high-confidence bot-condition issue and use unpinned actions.
62%
Total Score
50
100
94
50
The package runs a post-autoload-dump install-time script. This is relevant supply-chain surface, but the signal does not show that the script is unsafe.
The package and repository are owned by the same individual account. That is coherent ownership, though it indicates a narrower backing structure than an organization-owned project.
The package has 13 releases over 537 days, but only one release in the last 12 months, indicating a sparse recent cadence despite the latest release being available.
The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has recently slowed.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^10.0||^11.0||^12.0||^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.