This release appears usable but is not yet mature enough to rate as fully healthy. It is a stable, non-deprecated package backed by an organization-owned repository, with a recent push, a real license file, a substantial generated API surface, and no install-time lifecycle scripts. However, the package is only 90 days old with three releases, has just two commits in the last three months from one contributor, lacks tests and a changelog, and has no security policy or security-scanning tooling. The organization backing and recent activity reduce abandonment concerns, but the thin observed maintenance and verification record warrant caution before adopting it as a critical dependency.
68%
Total Score
67
81
83
A 3,303-character README and repository documentation provide usage and installation guidance, but neither the artifact nor repository has tests or a changelog. For an API client, missing tests reduce verification confidence and the absent changelog reduces release transparency.
The package is only 90 days old and has three releases, with a median interval of about 45 days. This demonstrates some release activity but leaves a limited track record for judging long-term maintenance.
All two recent commits came from one contributor, creating a concentrated observed maintenance base. The organization-owned repository provides some capacity to hand maintenance off, but no second active contributor is evidenced.
The repository recorded two commits in the last three months, showing recent maintenance but at a low cadence. The limited activity is a caution for a relatively new package rather than evidence of abandonment.
Composer is used as a build tool, but no security-scanning tools are detected. The build setup is appropriate, while the absent scanning reduces security-process transparency.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/psr7 Version ^1.7 || ^2.0 | — | — |
guzzlehttp/guzzle Version ^7.3 | — | — |
jumbojett/openid-connect-php Version ^0.9.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.