Documentation, tests, and release notes are strong, and the repository is still active. The long gap since the last registry release, one-person recent activity, absent security policy, and unpinned workflow actions merit caution.
68%
Total Score
60
100
88
75
Only one account has registry publish access. The linked repository is user-owned rather than organization-owned, so there is no provided backing signal to offset this concentration.
The package has existed for about 9 years with seven releases, but it has had no registry release in the last 12 months and the latest release was in December 2022. That is a meaningful release-maintenance concern.
All recent commit activity comes from one contributor, with a 100% share. The user-owned project has no provided organizational backing to compensate for this single-maintainer concentration.
The repository recorded one commit in the last three months, so activity has not vanished, but the pace is very low for a package with no recent registry release.
There are no open issues and two open pull requests, but no issues or pull requests were closed or merged in the last month. This provides limited evidence of active user-facing maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
react/stream Version ^1.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.