The package includes tests, a changelog, clear MIT licensing, and recent registry activity. Its small audience, single publisher, absent security policy, and partially unpinned workflow references leave meaningful maintenance and build-hygiene concerns.
68%
Total Score
50
50
94
67
The package declares 13 runtime dependencies for a Symfony attachment-management bundle, a substantial but plausible integration surface that adds some upkeep burden without showing an excessive profile.
Only one registry account has publishing access. The repository is user-owned rather than organization-backed, so there is limited visible publishing redundancy.
The package and repository are consistently owned by the same individual, and the repository owner type is User rather than an organization, providing direct ownership but limited institutional backing.
There were no commits and no active maintainers in the last three months. The recent June release partly offsets this, but the current source activity is still quiet.
The repository has no stars or forks and only one watcher. Popularity is supporting evidence rather than a verdict, but this provides little community evidence to offset the small maintainer base.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/uid Version ^5.4 || ^6.4 || ^7.4 | — | — |
symfony/mime Version ^5.4 || ^6.4 || ^7.4 | — | — |
symfony/yaml Version ^5.4 || ^6.4 || ^7.4 | — | — |
symfony/cache Version ^5.4 || ^6.4 || ^7.4 | — | — |
symfony/config Version ^5.4 || ^6.4 || ^7.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.