The package is small and clearly tied to its repository, with tests and a proper license. Maintenance depends on one contributor, and its workflow uses two unpinned actions; keep that risk in mind for production.
58%
Total Score
63
100
89
50
Only one account has registry publish access. The linked repository is also owned by an individual rather than an organization, so there is no visible organizational handoff capacity to compensate for that concentration.
The registry namespace and repository are owned by the same individual account, confirming coherent ownership but not providing organizational backing beyond that person.
The package has 20 releases in roughly 6.5 months, showing active publishing, but the median interval is about 11 minutes, indicating unusually compressed release activity and possible release churn.
All 31 recent commits came from one contributor, giving the project a complete single-person commit concentration. With individual ownership, this leaves maintenance vulnerable if that contributor becomes unavailable.
The repository has only 1 star, 1 fork, and 0 watchers. Popularity is supporting evidence rather than a verdict, but these counts provide little external validation for a package handling source protection.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/support Version ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.0 || ^12.0 || ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.