The package includes tests, release notes, a clear license, and a small runtime dependency surface. All workflow actions are unpinned, no security policy is present, and recent repository activity is absent; pin this version only if its frozen behavior is acceptable.
68%
Total Score
75
100
88
75
This package has only one release, published about 10 months ago, so there is little release history from which to judge sustained maintenance.
There were no commits and no active maintainers in the last three months, weakening evidence of ongoing maintenance after the initial release.
The project uses Composer and Make, but no security scanning tools were detected, leaving a modest security-process gap.
The repository has no security policy, reducing transparency about how vulnerability reports are handled.
Both workflows were analyzed successfully with no audit findings or untrusted checkouts, but all 6 action references are unpinned and one workflow grants top-level write access, creating avoidable workflow supply-chain and permission risk.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.