david-lobo/decomposer
The package has no security scanning and only one registry maintainer. Its small dependency set and matching, non-archived repository provide limited reassurance, but maintenance and transparency remain weak.
42%
Total Score
25
100
56
50
Health Score Breakdown
Neither the package nor the repository provides a declared or detected license file. This creates a material legal and reuse concern for dependents.
This is the only release, published about 18 months ago, with no releases in the last 12 months. That leaves little evidence of ongoing maintenance.
The repository recorded no commits and no active maintainers in the last 3 months, reinforcing the risk that development has stalled.
Only one registry account can publish releases. As an individual-owned project this is not unusual, but it leaves a thin publishing base with limited continuity.
The artifact has no README, tests, or changelog. Missing tests and changelog are normal for a published artifact, but the absent README makes integration and consumer understanding harder.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 davidlobo |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 guzzlehttp/guzzle Version ^7.0.1 | — | — |
t4web/composer-lock-parser Version ^1.2 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.