Use psr/http-message as a Valinor source
66%
Total Score
caution
A recent stable release is offset by no recent commits, one maintainer, and completely unpinned workflow actions.
Only one registry account has publishing access, leaving limited publishing resilience if that maintainer becomes unavailable; the repository is user-owned rather than organization-backed.
The registry namespace and repository owner match, but both identify an individual user rather than an organization, so there is limited visible institutional backing.
There were no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance despite the recent registry release.
The repository has one star and no forks, so there is little community evidence to supplement the maintainer's activity.
Composer build tooling is present, but no security scanning tools were detected, leaving a repository hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
cuyz/valinor Version ^2.3 | — | — |
psr/http-message Version ^1.0 || ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.