Usable with caveats: the package is clearly identified, licensed, documented, and not deprecated or archived. However, it has only one release and no commits in the last three months, so its maintenance capacity is unproven.
60%
Total Score
50
100
83
83
The registry namespace and repository owner match, and the repository is owned by a user account rather than an organization; this provides ownership consistency but limited evidence of institutional backing.
This is the package's only release, published about 10 months ago, so there is little history demonstrating sustained maintenance or compatibility work.
The repository had zero commits and zero active maintainers in the last three months; combined with the single-release history, this is the main evidence that ongoing maintenance is unproven.
The repository has no stars, forks, or watchers, offering no community adoption or review signal. This is supporting evidence rather than a decisive problem for a small API client.
Composer is used for the build, but no security scanning tooling is configured, leaving automated security and maintenance checks unconfirmed.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.