Healthy and suitable to use, with some maintenance caveats. It has a long release history, an active organization-backed repository, tests and release notes, but recent commits are concentrated in one contributor and issue resolution has been quiet.
78%
Total Score
63
50
94
80
The package declares 19 runtime dependencies, including framework, storage, analytics, and authentication integrations. This breadth increases upgrade and compatibility surface, but is plausible for a full CMS toolkit and is not itself evidence of abandonment.
The package runs a post-autoload-dump script during installation. This is an operational consideration because dependency installation executes package code, but the signal alone does not indicate abandonment or poor maintenance.
All 5 commits in the last 3 months came from one contributor, creating a current concentration risk. Organization backing provides some ability to hand off maintenance, so this is a caution rather than a severe abandonment signal.
The repository received 5 commits in the last 3 months, so activity has not stopped, but the volume is modest for a substantial framework package.
There were no new or closed issues in the last month and no merged pull requests, while 2 pull requests were opened. This indicates some current activity but limited recent resolution of outstanding work.
| Title | Versions | Severity |
|---|---|---|
CVE-2021-3932 area17/twill is vulnerable to Privilege Chaining in versions 0.0.0 - 1.2.5 and 2.0.0 - 2.5.3. | 0.0.0 - 1.2.52.0.0 - 2.5.3 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
laravel/ui Version ^4.0 | — | — |
spatie/once Version ^3.0 | — | — |
doctrine/dbal Version ^3.0 || ^4.0 | — | — |
imgix/imgix-php Version ^3.0 | — | — |
kalnoy/nestedset Version ^6.0 || ^7.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.