The stable major version, small dependency surface, and lack of install-time scripts limit day-to-day integration risk. Check licensing carefully because bundled license texts do not match the declared MIT license.
38%
Total Score
0
38
50
The package has had only two releases, with the latest about 12 years ago and none in the last 12 months. This is strong evidence of abandonment despite the short original release interval.
The repository recorded no commits and no active maintainers in the last 3 months, consistent with the long release hiatus. The repository is not archived, but there is no recent activity to offset the maintenance concern.
The package declares MIT and includes license files, so it is not unlicensed; however, those files identify MPL-1.1, GPL-2.0, and LGPL-2.1 material, creating a meaningful mismatch that requires licensing review.
The repository name does not match the package name and its README does not mention the package, so the link may not clearly establish package ownership. The organization-backed repository provides some context but does not resolve this identity gap.
The repository uses Composer, which provides build tooling, but it has no security-scanning tools. That is a modest hygiene gap rather than a standalone adoption blocker.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
bigfoot/core-bundle Version ~2.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.