It has clear licensing, a useful README, repository tests, and a stable release. Workflow references are unpinned and one uses an archived action, while recent work comes from one contributor with limited activity.
68%
Total Score
63
100
88
50
Only one account has registry publish access. The linked repository is user-owned rather than organization-owned, so there is no organizational backing shown to offset this concentration.
The package is 575 days old with five releases and one release in the last 12 months; a median interval of about 83 days suggests a modest rather than rapid cadence.
All recent commits came from one contributor, giving the project a complete short-term bus-factor concentration with no second active contributor shown.
The repository recorded one commit in the last three months from one active maintainer. This shows some maintenance, but the pace is sparse for a dependency.
Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency gap, partly offset by the repository's tests and static-analysis workflow.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
getkirby/composer-installer Version ^1.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.