dayemsiddiqui/langfuse-sdk
The package is clearly documented and licensed, with a small dependency footprint. Its one-person project has made no commits or releases for about a year, while CI configuration needs tightening before relying on it long term.
56%
Total Score
50
92
50
Health Score Breakdown
Only two releases were published on the same day, and there have been no releases in the last 12 months despite the package being about 442 days old. This limits evidence of sustained maintenance.
The repository recorded zero commits and zero active maintainers in the last three months. Combined with the lack of recent releases, this indicates materially reduced maintenance activity.
There are four open pull requests but no new or merged pull requests in the last month, providing little evidence that pending project work is being handled.
All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in a Dependabot auto-merge workflow. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe standalone risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Dayem Siddiqui |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 illuminate/contracts Version ^10.0||^11.0||^12.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.