The package includes tests, release notes, a substantial source tree, and clear organizational backing. Its last registry release was about four years ago, repository activity has stopped, and the artifact’s AGPL-3.0 license conflicts with its MIT declaration.
42%
Total Score
50
100
78
83
The latest release was published about four years ago, with no releases in the last 12 months. That is a substantial abandonment concern for a full application package.
There were zero commits and zero active maintainers in the last three months, and the last recorded push was about two years ago. This is strong evidence that maintenance has effectively stopped.
The artifact contains a license file, but it identifies AGPL-3.0 while the manifest declares MIT. This unresolved mismatch creates a meaningful legal and transparency concern.
Install-time Composer scripts run post-autoload and project-creation actions. Such scripts are expected for an installable Laravel application, but they increase installation sensitivity.
There were no new or closed issues and no merged pull requests in the last month, while 386 issues remain open. This indicates little current project attention.
| Title | Versions | Severity |
|---|---|---|
CVE-2022-0372 bytefury/crater is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 6.0.0. | 0.0.0 - 6.0.0 | Medium |
CVE-2022-0203 bytefury/crater is vulnerable to Improper Access Control in versions 0.0.0 - 6.0.2. | 0.0.0 - 6.0.2 | Medium |
CVE-2022-0242 bytefury/crater is vulnerable to Unrestricted Upload of File with Dangerous Type in versions 0.0.0 - 6.0. | 0.0.0 - 6.0 | High |
CVE-2021-4080 bytefury/crater is vulnerable to Unrestricted Upload of File with Dangerous Type in versions 0.0.0 - 6.0.0. | 0.0.0 - 6.0.0 | High |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
laravel/ui Version ^3.0 | — | — |
doctrine/dbal Version ^2.10 | — | — |
predis/predis Version ^1.1 | — | — |
laravel/tinker Version ^2.0 | — | — |
silber/bouncer Version v1.0.0-rc.10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.