The MIT license, matching repository, and stable version provide basic transparency. That does not offset the package being abandoned and marked deprecated, so pinning it would leave you without an active maintenance path.
8%
Total Score
25
56
75
Packagist marks the entire package as abandoned, with no replacement provided. This directly indicates that new projects should not depend on it.
The latest release was in October 2022, with no releases in the last 12 months; the package has therefore had nearly four years without a registry release.
There were zero commits and zero active maintainers in the last three months, corroborating the release and archive evidence of inactive maintenance.
The linked repository is archived, which is a severe maintenance warning even though it was pushed in April 2025.
The repository is owned by a user account rather than an organization, so the available ownership evidence does not show broader institutional backing.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.