A simple self-hosted bot for automating posts to Mastodon servers
58%
Total Score
0
75
50
The package has had no releases in more than three years despite eight releases in its first six weeks, indicating prolonged inactivity rather than an established current cadence.
There were zero commits and zero active maintainers in the last three months, consistent with the last push being in February 2023 and materially increasing abandonment risk.
The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities; this is a transparency and maintenance gap.
Version 0.4.0 is a non-prerelease release, but the project remains below a stable major version, which provides less maturity evidence alongside the long release gap.
Both workflows were analyzed without dangerous triggers or audit findings, but all four action references are unpinned, weakening build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
psr/clock Version ^1.0.0 | — | — |
crell/serde Version ^0.5.0 | — | — |
symfony/yaml Version ^6.3 | — | — |
pimple/pimple Version ^3.0 | — | — |
colorfield/mastodon-api Version dev-master | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.