dv-team/elastica
It is clearly licensed, and the source includes tests and a changelog. However, this is a one-off fork whose own README says not to use it, with no commits in three months. Pin the original Elastica package instead.
35%
Total Score
50
67
75
Health Score Breakdown
The artifact has a README and changelog, while the source has tests and a changelog. However, the README explicitly identifies this as a fork and says not to use it, which is a serious adoption concern.
The package has only one release, published 366 days ago, with no releases in the last 12 months. That provides little evidence of an ongoing maintenance path.
The linked repository recorded zero commits and zero active maintainers in the last three months. Combined with the one-release history, this indicates the fork is not being maintained.
The linked repository has no security policy. This weakens vulnerability-reporting transparency, though it is secondary to the release and maintenance concerns.
All one workflow was analyzed with no audit findings and no untrusted checkout or script-injection paths. However, all five action references are unpinned, leaving a modest reproducibility and workflow supply-chain hygiene gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Nicolas Ruflin |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1.0 || ^2.0 || ^3.0 | — | — |
elasticsearch/elasticsearch Version ^6.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.