cowegis/cowegis-core
This release is usable but warrants some caution. It is a stable, non-deprecated package with an identified organization-backed repository, an explicit LGPL license, a changelog, substantial source and specification files, Composer tooling, Dependabot, and no detected dangerous workflow patterns. However, its release history is sparse—only two releases across about 716 days with one release in the last 12 months—and the repository reports no commits or active maintainers in the last three months, which raises maintenance-continuity risk. The absence of a security policy and explicit workflow token permissions is also a transparency and CI-hardening gap, though there is no evidence here of repository archival or install-time lifecycle behavior.
68%
Total Score
88
100
89
80
Health Score Breakdown
Only two releases have been published over about 716 days, with one release in the last 12 months; this sparse cadence limits evidence of sustained maintenance and lowers confidence in long-term continuity.
The repository records zero commits and zero active maintainers over the last three months, despite a recent release and push timestamp. This weakens evidence of ongoing maintenance and creates abandonment risk.
The repository has zero stars and forks and one watcher. This indicates limited external adoption, but popularity is supporting evidence rather than a health verdict and does not by itself make the package unsafe to depend on.
The repository has no security policy. This is a transparency gap for reporting vulnerabilities and coordinating security maintenance, with no provided compensating policy evidence.
The sole workflow does not declare top-level token permissions. Although no write permissions were explicitly observed, the missing declaration is a CI hardening and transparency gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 David Molineus |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/container Version ^1.0 || ^2.0 | — | — |
beberlei/assert Version ^3.2 | — | — |
psr/http-message Version ^1.0 | — | — |
psr/event-dispatcher Version ^1.0 | — | — |
goldspecdigital/oooas Version ^2.8 | — | — |
Weekly Downloads
Info
- Last Published
- 24 days ago
- Created
- 2 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.