Consumer documentation and project structure are in good shape. The license declaration conflicts with the detected Unlicense, and all nine workflow actions are unpinned; active recent commits partly offset the package's short history.
67%
Total Score
100
79
67
The manifest declares MIT, but the artifact license file is detected as Unlicense. Although both the artifact and repository contain license files, the mismatch reduces clarity for adopters.
A post-autoload-dump install-time script runs during Composer installation. Such scripts expand installation behavior and deserve caution because the signal provides no evidence that the action is narrowly scoped.
The package is only 55 days old and has two releases, with a median interval of about 12 days. That shows initial activity but provides limited evidence of long-term maintenance.
The repository has no security policy. For a developer-facing package this is a transparency gap, though it is not evidence of abandonment by itself.
Version v0.2.0 is not a stable-major release, so its API and behavior may still change. It is not marked as a prerelease, which provides some compensating stability.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
vlucas/phpdotenv Version ^5.6 | — | — |
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
joshembling/artisan-browse Version ^0.0.7 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.