The package is clearly licensed, has a focused artifact, and uses no install-time scripts. Its organization-backed repository is not archived, but the prerelease has been unchanged for years and the registry marks the package abandoned.
15%
Total Score
100
50
100
Packagist marks the entire package as abandoned, with no replacement named. That is a direct warning against taking a new dependency on this release.
The latest release was published in November 2017, with no releases in the following 12 months; this indicates maintenance has stopped for roughly eight years.
The linked repository name does not match the package name and its README does not mention this package. That weakens confidence that the repository provides clear package-specific context, although the shared CoreShop organization is partial context.
The assessed version is still an alpha prerelease, and every recent release was a prerelease. Combined with the long release gap, this leaves the package without a mature stable release path.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
coreshop/core-bundle Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.