The small dependency set, MIT license, clear README, and release notes make the package straightforward to inspect and integrate. Its limited security safeguards and install-time scripts add maintenance and supply-chain concerns; pin this exact version rather than expecting ongoing support.
43%
Total Score
0
60
50
The package has had no release in over 9 years, with zero releases in the last 12 months. Its four-release history shows an initially regular cadence, but the long halt is a substantial abandonment concern.
The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the release history showing no activity since March 2017. The repository is not archived, but that does not compensate for the prolonged inactivity.
Post-install and post-update Composer scripts run during dependency operations, increasing the package's execution surface and warranting caution even though no malicious behavior is established here.
The repository has only 6 stars, 3 forks, and no watchers. Low popularity is supporting evidence rather than decisive, but it offers little external maintenance or review capacity to offset the inactivity.
Composer is used for the build, but no security-scanning tooling is reported. For an inactive package, the missing automated security coverage adds a transparency and maintenance gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
kriswallsmith/buzz Version ^0.15.0 | — | — |
bex/behat-screenshot Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.