The package has a clear license, a matching repository, and a release for this version. Maintenance has slowed, with no releases in the last 12 months and no commits in the last 3 months; the solo maintainer and lack of tests add modest risk.
68%
Total Score
67
100
83
83
Only one registry account can publish the package, creating a thin publishing base. The linked project is user-owned rather than organization-backed, so there is no provided organizational capacity to offset that risk.
The package has 31 releases since April 2017, but none in the last 12 months; this indicates slowed maintenance without proving abandonment because version 5.3.4 was released in May 2025.
There were no commits and no active maintainers in the last 3 months. This is a maintenance concern, although the package's latest release was still within the observed period.
The repository has no stars or forks and one watcher. Popularity is only supporting evidence, so this lowers confidence in community support slightly but does not outweigh the matching source and release history.
Composer is used as the build tool, but no security scanning tooling is present. This is a modest transparency and hygiene gap rather than evidence that the release is unsafe.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
dashifen/request Version ^2.0 | — | — |
dashifen/exception Version ^1.0 | — | — |
dashifen/collection Version ^2.1 | — | — |
dashifen/case-changing-trait Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.