This is a usable but still immature package with strong repository transparency and organizational backing. The linked repository is active, unarchived, correctly matched to the package, has tests and a changelog, uses Composer and Dependabot, and has recent merged pull requests. However, only two releases exist across roughly 439 days, the current version is still below 1.0, recent commit activity reports no commits or active maintainers, and the repository has workflow permission and security-policy gaps. These concerns warrant caution for a production dependency, though they do not indicate abandonment or make the package unfit to adopt.
68%
Total Score
75
100
83
60
One pull_request_target workflow is used for Dependabot auto-merge, but no untrusted checkouts or script-injection patterns were detected; the workflow choice merits review but is not a severe finding on these values.
A post-autoload-dump script is present; this is a normal Composer lifecycle hook, but it adds installation-time behavior that should be reviewed before adoption.
One registry publishing account is listed, which is a limitation for publishing continuity, but the repository is backed by an organization, partially compensating for the thin registry maintainer base.
Only two releases have been published over roughly 439 days, with one release in the last 12 months and a median interval of about 440 days; this indicates limited release maturity and slower maintenance cadence.
The repository reports zero commits and zero active maintainers during the last three months, which conflicts with the recent push and seven merged pull requests and creates uncertainty about sustained maintenance capacity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^10.0||^11.0||^12.0||^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
spatie/php-structure-discoverer Version ^2.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.