There is no repository security policy or automated security scanning, which limits transparency for a backend extension. The package is clearly documented, licensed, and tied to its source repository, but ongoing maintenance should be verified before adopting it.
58%
Total Score
50
100
88
75
The package and repository are owned by the same individual account rather than an organization. This is consistent ownership, but it provides no organizational backing to offset the quiet activity.
The package has six releases since June 2023, but none in the last 12 months; the latest release was on February 21, 2025. This indicates a real maintenance concern for a package tied to evolving TYPO3 versions.
There were zero commits and zero active maintainers in the last three months. Combined with the older latest release, this is meaningful evidence of currently quiet maintenance.
The repository uses Composer, but no security scanning tools are detected. Build tooling is present, while security-process transparency is limited.
No security policy is present in the linked repository. For a backend extension that processes and modifies database-stored TypoScript, this is a transparency gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-core Version ^13.4 | — | — |
a9f/typo3-fractor Version ^0.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.