This is a mature, licensed, transparently maintained package with a long release history, a substantial repository, tests in the source repository, and no registry deprecation or archival status. However, adoption carries meaningful lifecycle risk: the package README explicitly says it is no longer recommended because PHP 8.1 provides native enums, and repository commit activity shows zero commits and zero active maintainers in the last 3 months. The release itself is stable and recent, but the package appears to be in maintenance or migration mode rather than active feature development; depend on it primarily for compatibility with an existing Laravel codebase, not as the default choice for a new project.
58%
Total Score
38
50
94
70
There were zero commits and zero active maintainers in the last 3 months, a significant indication that maintenance activity has collapsed or that the project is effectively in maintenance mode.
Six runtime dependencies create a moderate dependency surface for a Laravel library, including framework and code-generation/parser components; this is a manageable but nontrivial maintenance burden.
A post-autoload-dump lifecycle script is present. This is an install-time execution surface that warrants review, but the signal does not indicate a dangerous script by itself.
Two registry publishing maintainers provide some continuity, but this is only administrative access evidence and does not compensate for the observed lack of recent repository activity.
The repository is owned by the individual user BenSampo rather than an organization, so the small two-person registry maintainer base is not supported by visible organizational backing.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nikic/php-parser Version ^4.13.2 || ^5 | — | — |
illuminate/support Version ^9 || ^10 || ^11 || ^12 || ^13 | — | — |
illuminate/contracts Version ^9 || ^10 || ^11 || ^12 || ^13 | — | — |
laminas/laminas-code Version ^3.4 || ^4 | — | — |
composer/class-map-generator Version ^1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.