The package has clear licensing, a matching organization-backed repository, a focused dependency set, and release notes for this version. The missing security policy and scanning reduce transparency, while low issue activity reinforces the maintenance concern.
64%
Total Score
67
100
81
50
The release declares GPL-2.0+ and includes a license file, so licensing is transparent. The detected GPL-2.0 text does not exactly match the declaration and warrants a small caution.
The package has existed since July 2019 with 11 releases, but only one release appeared in the last 12 months and the latest was January 2026. This indicates a slow maintenance cadence for the current release line.
The repository recorded zero commits and zero active maintainers in the last three months. The January release provides some recent evidence, but the current lack of activity lowers confidence in ongoing maintenance.
There are three open issues and one open pull request, with no new or closed issues or merged pull requests in the last month. This is limited evidence of current project responsiveness.
The repository uses Composer, but no security scanning tool is configured. That is a transparency and maintenance-process gap, though it is not evidence of unsafe code by itself.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-core Version ^12.4.41 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.