Its MIT license, focused dependency set, release notes, and matching repository improve transparency. No tests, security policy, or security scanning are present, so future compatibility and response capacity are harder to verify.
58%
Total Score
50
100
81
83
The registry namespace and repository owner match, and the owner is an individual rather than an organization. This is consistent ownership evidence, though it does not provide the capacity of organization backing.
The latest release was published on November 9, 2022, and there were no releases in the following nearly four years. The seven-release history shows an established package, but the prolonged release gap lowers maintenance confidence.
The repository had zero commits and zero active maintainers in the preceding three months. Combined with the release gap, this is evidence of very limited recent maintenance.
Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest repository hygiene gap rather than evidence that the release is unsafe.
The linked repository is not archived, but its last push was on November 9, 2022. The active archive status is positive, while the old last-push date is consistent with the maintenance concern already reflected by commit activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
samdark/sitemap Version ^2.2 | — | — |
tightenco/jigsaw Version ^1.3.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.