The stable release, tests, README, and MIT license provide useful baseline transparency. One maintainer, no recent commits, no security policy, and unpinned workflow actions leave little ongoing support evidence.
18%
Total Score
25
100
50
75
Packagist marks the entire package as abandoned, with no replacement package specified. This is a severe adoption warning beyond a single withdrawn release.
The package has six releases, but the latest was about 3 years and 5 months before collection and there were no releases in the previous 12 months. This shows a long release gap for a package still being considered for adoption.
The repository had zero commits and zero active maintainers in the previous 3 months. This supports the abandonment concerns, although it is consistent with the repository being archived.
The linked repository is archived, which strongly indicates that active maintenance has ended. Its last push was about 1 year and 10 months before collection, so the archive status is not merely cosmetic.
Only one registry account has publishing access. The matching user-owned repository provides some ownership clarity, but there is little visible publishing redundancy.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
league/csv Version ^9.3 | — | — |
getkirby/composer-installer Version ^1.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.