Usable with caveats: it is actively released, licensed, tested, and clearly backed by its matching repository. Recent source activity is very thin and entirely dependent on one contributor, with no security policy or automated security scanning.
72%
Total Score
50
100
94
90
Only one registry account has publish access, which creates release continuity risk, although the package has continued releasing and the repository owner matches that account.
The repository is owned by a user rather than an organization, so there is no organizational maintenance capacity to compensate for the narrow contributor base.
All recent commits come from one contributor, leaving the project vulnerable to interruption if that maintainer becomes unavailable; the repository is user-owned, so there is no organization backing to offset this concentration.
Only one commit was made in the last 3 months by one active maintainer, showing much weaker recent development activity than the release history suggests.
There are no open issues or pull requests, but there was also no issue or pull-request activity in the last month; this is neutral rather than evidence of strong community support.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
topthink/framework Version ^5|^6|^8.0 | — | — |
topthink/think-orm Version ^2.0|^3.0|^4.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.