It has an MIT license, useful documentation, release notes, repository tests, and organization backing. Maintenance has been quiet since late 2024, and all four workflow actions are unpinned.
64%
Total Score
75
92
50
The package has 16 releases since June 2020, but it has had no release in nearly two years and none in the last 12 months, which indicates materially slowed maintenance.
There were no commits and no active maintainers in the last three months. This reinforces the release gap and raises the risk that fixes may not arrive promptly.
No security policy is present in the repository. This is a modest transparency gap for a library that handles API credentials, though it is not evidence of an unsafe release by itself.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all four action references are unpinned, leaving a supply-chain hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-client Version ^1.0 | — | — |
psr/http-message Version ^1.0.1 || ^2.0 | — | — |
psr/simple-cache Version ^1.0 || ^3.0 | — | — |
php-http/discovery Version ^1.13 | — | — |
php-http/multipart-stream-builder Version ^1.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.