This is a usable, transparently sourced and properly licensed Contao extension with a stable 2.2.0 release, a matching repository, no registry deprecation, and no install-time lifecycle scripts. However, maintenance evidence is mixed: the package has existed since 2020 but has only seven releases, one in the last 12 months, and no commits or active maintainers in the last three months; it also lacks tests, a changelog, security policy, and repository security scanning. The package is therefore reasonable to adopt with normal dependency monitoring, but it is not strongly supported by recent maintenance or engineering-process evidence.
68%
Total Score
50
100
78
90
The repository recorded zero commits and zero active maintainers in the last three months, the strongest concern in this assessment because it suggests currently limited maintenance capacity.
A focused README documents usage, but neither the artifact nor repository contains tests or a changelog. For a small extension this is a meaningful maintenance and transparency gap, though the README provides basic consumption guidance.
The repository is owned by the e-spin user account rather than an organization, so the project does not show organization-level backing. This is a modest resilience concern, not a severe risk by itself.
The package has a substantial history of about 5 years and 7 releases, but only one release in the last 12 months and a median interval of about 227 days indicate slow maintenance cadence.
There are no open issues or pull requests, which is orderly but does not demonstrate active community maintenance because there was also no recent issue or pull-request activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
contao/core-bundle Version ^5.2 || ^6.0 | — | — |
contao/newsletter-bundle Version ^5.2 || ^6.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.