This release appears suitable to depend on from a maintenance and transparency perspective: it is a stable, non-prerelease version with nine releases over 90 days, was pushed recently, is not deprecated or archived, and is backed by an organization-owned repository. The main risks are that all eight recent commits came from one contributor, the package and repository have no tests or changelog, and the repository has no security scanning or security policy; these reduce resilience and transparency but do not indicate abandonment. The package is also young and has no observable popularity, so adoption should include normal pinning and upgrade review.
78%
Total Score
80
100
83
90
A 2,444-character README provides installation and usage guidance, but neither the artifact nor repository has tests or a changelog. For an API client this is a genuine transparency and regression-coverage gap.
One contributor made all 8 commits in the last 3 months, creating a low individual bus factor. Organization ownership partially compensates because maintenance can potentially be handed off internally, but no second active contributor is observed.
The repository recorded 8 commits in the last 3 months, showing recent activity, but all activity is concentrated in one active maintainer. The recent cadence is healthy while the narrow base reduces resilience.
The repository has 0 stars, forks, and watchers. This is weak supporting evidence and limits external validation, but popularity alone does not establish that a small organization-backed package is unhealthy.
Composer is used as a build tool, which fits the PHP package, but no security scanning tools are detected. The missing scanning lowers supply-chain hygiene without making the release unfit by itself.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/psr7 Version ^1.7 || ^2.0 | — | — |
guzzlehttp/guzzle Version ^7.3 | — | — |
jumbojett/openid-connect-php Version ^0.9.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.