Boilerplate for ArchFW
10%
Total Score
critical
Unfit to use: the package is deprecated and its source repository is archived.
Packagist marks the entire package as abandoned and provides no replacement. This is a direct warning against taking a new dependency on it.
This package has only one release, 2.7.0, published nearly eight years ago, with no releases in the last 12 months. That provides strong evidence of abandonment.
The linked source repository is archived, confirming that active project maintenance has ended. Its last push was nearly four years before the assessment.
The artifact contains a license file and the repository also has one, so licensing is present; however, the detected Apache-2.0 text conflicts with the manifest's MIT declaration and requires clarification.
The linked repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This adds a smaller concern alongside the stronger abandonment signals.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
twig/twig Version ^2.0 | — | — |
catfan/medoo Version ^1.6 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.