The MIT license, consumer README, tests in the repository, and static-analysis tooling provide useful transparency. However, the release appears tied to a repository with no recent development and uncertain package ownership, so pinning it carries substantial maintenance risk.
34%
Total Score
25
69
67
The package has 99 releases but none in the last 12 months; its latest registry activity was 3 years 11 months ago. This is strong evidence of abandonment for a framework integration package.
The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the registry's long release gap and indicating a serious maintenance risk.
The repository name does not match the package name and its README does not mention atheon/doctrine-bundle. That raises concern that the linked source may not actually belong to this package.
The registry namespace and repository owner are both the personal account Atheon, not an organization-backed project. This offers limited evidence of durable institutional support.
The linked repository has zero stars, forks, and watchers. Popularity is supporting evidence rather than a verdict, but this provides no visible community backing for a package with otherwise stalled activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
doctrine/dbal Version ^2.13.1|^3.3.2 | — | — |
symfony/cache Version ^4.3.3|^5.0|^6.0 | — | — |
doctrine/cache Version ^1.11 || ^2.0 | — | — |
symfony/config Version ^4.4.3|^5.0|^6.0 | — | — |
symfony/console Version ^3.4.30|^4.3.3|^5.0|^6.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.