Usable with caveats: the release is licensed, tested in its repository, clearly linked to the package, and not deprecated or archived. However, all eight releases arrived within about 24 hours and the repository has had no commits or active maintainers in the last three months, so ongoing maintenance is uncertain.
62%
Total Score
50
100
83
80
Only one registry publishing account is listed, which limits publishing redundancy; this is a concern alongside the repository's lack of recent activity, though it does not by itself establish abandonment.
The registry namespace is an organization name, but the linked repository is owned by an individual account; there is no provided evidence of organizational backing to offset the single-maintainer concern.
All eight releases were published in roughly 24 hours, showing initial release activity but little evidence of a sustained release history over the package's approximately 10-month lifetime.
The repository had zero commits and zero active maintainers in the last three months, despite the package being about 10 months old; this is the strongest evidence of uncertain ongoing maintenance.
There are no open issues or pull requests and no recent issue or pull-request activity; this may reflect a small, quiet project rather than health, and does not compensate for the absence of recent commits.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
yiisoft/yii2 Version ^2.0.45 | — | — |
yiisoft/yii2-composer Version ^2.0.11 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.