The repository is clearly tied to the package, licensed, documented, and backed by an organization with tests and release notes. Security coverage is limited, and the workflow uses seven unpinned actions, increasing maintenance and build-integrity concerns.
64%
Total Score
83
92
50
The package has 20 releases over about 2 years and 11 months, but only one release in the last 12 months; this indicates materially slower delivery despite a previously regular cadence.
The repository recorded no commits and no active maintainers in the last 3 months, which is a meaningful recent maintenance gap, although it is not archived and was pushed within the wider assessment period.
No security policy is present, leaving vulnerability reporting and response expectations undocumented for a package intended as a reusable library.
The single workflow was fully analyzed with no dangerous sinks or audit findings, but all 7 action references are unpinned. That leaves the build exposed to mutable action changes and is a hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-factory Version ^1.1 | — | — |
psr/http-message Version ^2.0 | — | — |
decodelabs/nuance Version ^0.2 | — | — |
decodelabs/compass Version ^0.4 | — | — |
decodelabs/kingdom Version ^0.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.