The package includes tests, release notes, and a clear MIT declaration. Organization backing and a non-archived repository provide continuity, but workflow dependencies are not pinned.
61%
Total Score
75
90
The package has 12 releases since December 2020 with a typical interval of about 51 days, but no releases in the last 12 months and the latest was in August 2024. This is meaningful evidence of slowing or stopped maintenance.
The repository recorded no commits and no active maintainers in the last three months, consistent with the long release gap. This raises abandonment risk even though the project is not archived.
All seven analyzed workflow action references are unpinned, which weakens build reproducibility. The reported cache-poisoning findings have low confidence and are hygiene concerns rather than a severe risk on their own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
sylius/sylius Version ~1.12.0 || ~1.13.0 | — | — |
symfony/http-client Version ^5.4 | ^6.0 | — | — |
bitbag/shipping-export-plugin Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.