The MIT license, clear README, and release notes make the package understandable to adopt. Its small single-user project and lack of recent activity leave maintenance capacity and long-term support uncertain.
55%
Total Score
50
90
75
One registry publishing maintainer is a thin operational base for an individually owned project, increasing continuity risk if that person becomes unavailable.
The package has 24 releases, but none in the 12 months before collection; its latest release was about 15 months ago. This indicates maintenance has stopped or slowed substantially.
The repository recorded no commits and no active maintainers in the last 3 months, reinforcing the long period without a release.
The repository has no security policy, reducing transparency about how consumers should report vulnerabilities. This is a hygiene gap rather than evidence of an unsafe release.
The workflow uses read-only permissions and has no audited dangerous findings, which is positive. However, both analyzed action references are unpinned, leaving avoidable build-reproducibility risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
sentry/sentry Version ^4.8 | — | — |
twbs/bootstrap Version ^5.3 | — | — |
ecxod/funktionen Version ^1.0 | — | — |
vlucas/phpdotenv Version ^5.6 | — | — |
twbs/bootstrap-icons Version ^1.13 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.