This is a generally healthy, usable test-helper package: it has a clear BSD-3-Clause license, complete source and test files, stable releases, no deprecation, no install-time lifecycle scripts, and an organization-backed repository that is not archived. The main concerns are limited ecosystem adoption, no recorded commit activity or active maintainers in the last 3 months despite a recent release, and incomplete repository security hygiene (no security policy and no top-level workflow permissions). These issues warrant monitoring, but the package remains a reasonable dependency for projects that accept its small contributor and adoption footprint.
78%
Total Score
67
50
89
80
The package declares only three runtime dependencies, keeping the dependency surface modest, although PHPUnit as a runtime dependency is notable for a test-helper library and should be checked against the consuming project's setup.
No commits and no active maintainers were recorded in the last 3 months, despite the latest registry release being recent. This creates a meaningful maintenance-continuity concern, although the recent release and non-archived repository provide partial counterevidence.
There are no open issues or pull requests and no recent issue or pull-request activity. A clean tracker is not inherently negative, but it provides little evidence of an active external maintenance community.
The repository has only 1 star, 0 forks, and 2 watchers. This is weak supporting evidence and suggests limited external adoption, though popularity alone does not make a small maintained package unsafe.
Composer build tooling is present, but no security scanning tools were detected. The absence of scanning lowers repository security hygiene, while the package's coherent CI and test structure provide some compensation.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
phpunit/phpunit Version ^11.0 | — | — |
guzzlehttp/guzzle Version ^7.15.2 || ^8.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.