A single maintainer and no commits in the past three months reduce confidence in ongoing support. The package is well documented and tested, but its workflow has a high-confidence floating container-image issue.
65%
Total Score
50
86
50
One registry maintainer is a thin publishing base for a user-owned project. The linked repository matches the package and has recent activity, which limits but does not remove the support risk.
The package has existed since September 2022 but has only four releases, with one release in the last 12 months. That suggests a small and relatively quiet release history, though the assessed version is recent.
There were no commits and no active maintainers in the past three months. Although a recent release exists, the lack of current commit activity lowers confidence in ongoing maintenance.
The repository has four open pull requests, with no new or merged pull requests in the past month. This indicates unresolved contribution activity, though there are no open issues.
The repository has no security policy. This is a transparency and reporting gap, but it is not by itself evidence that the package is unsafe to depend on.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
broadway/broadway Version ^2.4.0 | — | — |
async-aws/dynamo-db Version ^1.3.0 || ^3.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.