The package includes a README, tests, and a matching source repository, with no install-time scripts. Its latest release was over a year ago and there were no commits in the past three months; the license mismatch and unpinned workflow actions add smaller concerns.
61%
Total Score
50
100
80
75
The artifact contains a license file and the repository also has one, but the manifest declares GPL-2.0-or-later while the detected text is GPL-3.0; that mismatch reduces transparency.
The package has 25 releases since July 2021, but none in the past 12 months despite a latest release in September 2025, indicating a prolonged release pause.
The repository recorded 0 commits and 0 active maintainers in the past three months, which is a meaningful maintenance and abandonment concern.
Both workflows were fully analyzed with no dangerous triggers, sinks, or audit findings, but all 3 action references are unpinned, leaving avoidable workflow reproducibility and update risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-backend Version ^13.4.18 || dev-main | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.