Its long release history, stable version, and organization backing provide useful continuity. The repository has no security policy and very little visible adoption, leaving maintenance transparency weaker than the release cadence suggests.
61%
Total Score
75
86
75
The repository recorded zero commits and zero active maintainers during the last 3 months. That conflicts with the frequent registry releases and weakens confidence in ongoing source maintenance.
The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent and may indicate repository piggy-backing.
The repository has zero stars and forks and only one watcher. Popularity is supporting evidence rather than a verdict, but this provides little independent evidence of broad adoption.
No security policy was found in the linked repository, leaving vulnerability reporting and response expectations undocumented for a package used in ecommerce systems.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
coreshop/order Version ^2026.1 | — | — |
pimcore/pimcore Version ^2026.2 | — | — |
coreshop/registry Version ^2026.1 | — | — |
coreshop/rule-bundle Version ^2026.1 | — | — |
coreshop/money-bundle Version ^2026.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.