The package has clear documentation, an MIT license, a changelog, and a modest runtime dependency set. However, it has only one release after 33 days and one registry maintainer, so maintenance capacity and long-term stability remain unproven.
57%
Total Score
50
100
75
75
The package runs a post-autoload-dump install-time script. Such scripts can be legitimate in Composer packages, but they add execution during installation and warrant extra scrutiny.
The registry lists one maintainer, providing limited visible ownership capacity for review, releases, and issue response. This is a meaningful resilience concern, though it does not prove abandonment.
This is a young package, 33 days old, with only one release and no established release interval. That limited history leaves maintenance and stability unproven.
Version v0.1.0 is not a stable major release, which indicates an early-stage API and a higher likelihood of breaking changes. There is no prerelease labeling to worsen this.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
rybakit/msgpack Version ^0.10.0 | — | — |
saloonphp/saloon Version ^4.0 | — | — |
illuminate/support Version ^12.0||^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.