The package has clear documentation, tests in its repository, a license, and active project tooling. However, no commits were recorded in the last three months, while workflows use all 12 actions without pinning and contain a high-confidence bot-condition finding.
58%
Total Score
63
100
89
75
The repository recorded zero commits and zero active maintainers in the last three months. For a package released only a few months ago, that is a meaningful warning about current maintenance capacity.
A post-autoload-dump install-time script runs during Composer installation. This adds some installation complexity, but the signal alone does not show harmful or excessive behavior.
The package is young at 209 days, with three releases and a median interval of about 40 days. That shows a real release cadence, though the limited history provides only modest evidence of long-term maintenance.
There are no new or closed issues in the last month and two open pull requests. This shows limited visible collaboration and leaves the pending work unresolved.
The repository has zero stars, forks, and watchers. Popularity is supporting evidence rather than a verdict, but these counts provide no external adoption signal for this young package.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
phpoffice/phpspreadsheet Version ^1.0||^2.0||^3.0||^4.0||^5.5 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.