Tests, release notes, a license, and security scanning provide useful maintenance and transparency signals. The single maintainer and unpinned workflow actions add modest ongoing risk.
62%
Total Score
50
94
Only one registry publishing maintainer is listed, which creates some continuity risk for a library with a broad API surface. The repository is not archived and shows a matching owner, partly offsetting this concern.
The package has four releases, but none in the last 12 months; its latest release was about 1 year and 6 months ago. This suggests maintenance has slowed materially.
The repository recorded zero commits and zero active maintainers in the last 3 months. Although it was pushed more recently than that window, current development activity is limited.
The only workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but both of its two action references are unpinned. That is a modest reproducibility and supply-chain hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
stephenhill/base58 Version ^1.1 | — | — |
symfony/serializer Version ^7.2|^6.4 | — | — |
symfony/http-client Version ^7.2|^6.4 | — | — |
simplito/elliptic-php Version ^1.0 | — | — |
symfony/property-access Version ^7.2|^6.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.