MIT licensing, release notes, and a matching organization repository improve transparency. The workflow is fully unpinned and the repository has no security policy or scanning, so maintenance and build provenance remain weaker than ideal.
65%
Total Score
75
100
88
75
The project has existed for about seven years with 19 releases, but it has published no registry release in roughly 13 months, which weakens confidence in ongoing maintenance.
No commits and no active maintainers were observed in the last three months, a meaningful sign of currently limited development activity despite the recent repository push.
Composer build tooling is present, but no security scanning tools were detected, leaving a transparency and maintenance gap.
The repository has no security policy, so users have no documented security-reporting process or disclosure expectations.
The workflow audit completed without high-confidence findings or untrusted triggers, but all seven action references are unpinned. That weakens build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
decodelabs/tagged Version ^0.21 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.