The package has been untouched for about five months after a rapid three-release start, with only one publisher account and little community adoption. Its repository has tests, a clear README, matching source, read-only workflow permissions, and Composer security scanning.
68%
Total Score
33
100
81
67
The repository recorded zero commits and zero active maintainers in the last three months, and its last push was about five months ago. For a package this young, that is the clearest maintenance-risk signal.
Only one account has registry publishing access, and the project is backed by a personal repository rather than an organization. This concentrates publishing responsibility, though the registry list alone does not establish inactivity.
The package and repository are owned by the same individual account, with no organization backing shown. This provides direct ownership consistency but limited evidence of broader maintenance capacity.
The package is young at 163 days and had three releases in its first five days, but no later releases are recorded. That leaves maintenance continuity uncertain rather than proving abandonment.
The repository has one star and no forks, offering little community evidence to offset the limited maintenance history. Low popularity is supporting evidence, not a standalone abandonment verdict.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2.0 | ^3.0 | — | — |
symfony/uid Version ^6.4 | ^7.4 | ^8.0 | — | — |
symfony/config Version ^6.4 | ^7.4 | ^8.0 | — | — |
symfony/console Version ^6.4 | ^7.4 | ^8.0 | — | — |
symfony/http-kernel Version ^6.4 | ^7.4 | ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.