This release appears usable and actively maintained: it has 143 releases over roughly 2.7 years, 63 releases in the last 12 months, a stable non-prerelease version, a current unarchived repository, licensing, documentation, tests, and no install-time lifecycle scripts. The main concerns are concentrated recent development in a single contributor, seven open pull requests with no recent merges, very low repository popularity, and no security-scanning tooling or security policy. Organization ownership provides some maintenance backing, but the limited observed contributor activity and incomplete security transparency warrant caution rather than an unqualified recommendation.
74%
Total Score
63
50
89
88
The framework declares 15 runtime dependencies, largely aligned with its documented Google Cloud integrations; this adds update and transitive-dependency surface but is not inherently unhealthy for this package type.
All five recent commits came from one contributor with a 100% share. Organization ownership provides some ability to transfer maintenance, but no second active contributor is evidenced, leaving a genuine continuity risk.
Only five commits were recorded in the last three months. Releases remain frequent, but the low recent commit volume indicates limited observed development activity behind the release cadence.
There are seven open pull requests, but no new or merged pull requests and no issue activity in the last month; this suggests review or integration activity may be limited.
The repository has only 1 star, 0 forks, and 5 watchers. Popularity is supporting evidence rather than a verdict, but these low adoption indicators provide little external validation.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
google/apiclient Version ^2.18 | — | — |
google/cloud-iam Version ^1.2 | — | — |
google/cloud-kms Version ^2.5 | — | — |
google/cloud-core Version ^1.68 | — | — |
mustache/mustache Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.