There is no repository security policy, and the project has a sparse release cadence. The MIT license, matching repository, tests, and release notes provide useful transparency.
70%
Total Score
75
80
50
The package has existed since 2018 with 14 releases, but only 1 release in the last 12 months and a median interval of about six months show a sparse cadence. Its latest release is recent enough to provide some evidence that the project is not abandoned.
The repository recorded 0 commits and 0 active maintainers in the last three months, which indicates limited recent maintenance capacity. The release on 2025-11-01 provides some evidence of continued activity but does not offset the recent silence entirely.
Composer is used for the build, but no security-scanning tool is configured. That modestly reduces automated maintenance coverage without outweighing the package's other project evidence.
The linked repository has no published security policy, leaving vulnerability-reporting and response expectations unclear. This is a transparency gap, though it is not evidence that the package is unsafe.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
dmt-software/jms-soap-serializer Version ^2.1|^3.0 | — | — |
dmt-software/command-bus-validator Version ^1.0|^2.0 | — | — |
dmt-software/http-client-middleware Version ^0.1.3 | ^1.0 | ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.