The package has no README, declares a proprietary license, and its source repository could not be found. Tests are included and installation has no lifecycle scripts, but the release history indicates prolonged inactivity.
38%
Total Score
50
60
100
The package is 1,587 days old, has five releases, and has had no release in the last 12 months; its latest release was in May 2022, indicating substantial abandonment risk.
The package declares five runtime dependencies, including PHPUnit as a runtime dependency and two cryptographic or PDF-related libraries; this adds maintenance and supply-chain surface without evidence of recent upkeep.
A proprietary license is declared in the manifest, so the release is licensed, but it may impose usage restrictions that matter to adopters of an open-source dependency.
Tests are present in the artifact, which is a positive quality signal, but the package has no README despite being a library that consumers must integrate.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
iio/libmergepdf Version ^4.0 | — | — |
phpunit/phpunit Version ^9.5 | — | — |
tecnickcom/tcpdf Version ^6.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.