The package has a clear license, repository tests, and no install-time scripts. Maintenance and release evidence are too stale for a dependable new dependency; pinning this version would leave you carrying the update risk.
45%
Total Score
0
67
75
The package has made 24 releases overall, but none in the last 12 months and its latest release was over four years ago. This is strong evidence of abandonment risk.
The repository had zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating no recent maintenance capacity.
The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but these counters provide no external adoption signal to offset the stale maintenance record.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it does not outweigh the maintenance evidence alone.
The registry reports latest version 2.0.3 while the assessed release is 3.0.1, creating uncertainty about the release line and published version state.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
softcreatr/jsonpath Version ^0.8 | — | — |
codeception/codeception Version ^5.0.0-alpha2 | — | — |
justinrainbow/json-schema Version ~5.2.9 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.