cybertroniankelvin/graper
Clear documentation, repository tests, licensing, and a security policy improve transparency. Pin this version and review the project before relying on it for production page publishing.
60%
Total Score
50
100
94
75
Health Score Breakdown
All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently severe.
A post-autoload-dump script runs during installation, adding execution surface during dependency setup; no compensating detail about its behavior is provided.
One registry maintainer matches the user-owned repository backing, which is consistent publishing ownership but leaves limited apparent publishing redundancy.
The repository is owned by an individual rather than an organization, so the single-maintainer and single-contributor concentration represents genuine continuity risk.
Only two releases have appeared over roughly 145 days, with both released within about three days; this establishes a young project but not a proven long-term cadence.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Kelvin Atawura |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 filament/filament Version ^5.0 | — | — |
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Weekly Downloads
Info
- Last Published
- 5 months ago
- Created
- 5 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.