This is a usable and apparently actively released Drupal recipe, with 10 releases over 134 days, a stable non-prerelease version, an explicit GPL-2.0-or-later license, a README, and a changelog. However, the package has no declared source repository, so maintenance transparency and repository-level activity cannot be verified; it also has a broad runtime dependency set of 31 packages and no packaged tests, increasing adoption and maintenance complexity. Overall it is suitable with caution, but dependency on it should account for limited observability and its substantial transitive dependency surface.
68%
Total Score
50
50
90
100
The recipe declares 31 runtime dependencies and no development dependencies, creating a broad transitive maintenance and compatibility surface for adopters; the dependencies are consistent with the many admin features described by the package.
Only one registry account, Vardot, is listed with publish access. This does not establish weak engineering capacity by itself, but combined with the absence of repository-level signals it leaves limited independently verifiable maintainer depth.
The artifact includes a substantial README and a changelog, which document the recipe and its changes; the absence of packaged tests is a maintenance gap, although this is a configuration-oriented recipe rather than a conventional library.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
drupal/eca Version ~3 | — | — |
drupal/gin Version ~5 | — | — |
drupal/core Version ~11.4.0 | — | — |
drupal/trash Version ~3 | — | — |
drupal/coffee Version ~2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.