This is a usable but relatively young package with strong basic transparency: it has an MIT license, README and changelog, repository tests, a matching source repository, stable releases, and no deprecation or archival status. However, the repository shows no commits or active maintainers in the last 3 months despite a highly concentrated release history, and it is backed by a single individual with very limited popularity. Missing security scanning and security policy, plus permissive or unspecified workflow token permissions, add supply-chain hygiene concerns. Overall, it is reasonable to evaluate for a development-only dependency, but adoption should account for uncertain sustained maintenance and limited project backing.
68%
Total Score
38
100
83
80
The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although a release was published recently, the lack of observed commit activity materially weakens evidence of sustained maintenance.
Only one registry maintainer, Mohamed Said, has publish access. The matching user-owned repository provides some accountability, but the single-person publishing base increases continuity risk.
The repository is owned by an individual user rather than an organization, so there is limited institutional backing to compensate for the single-maintainer structure.
The package is only 176 days old and has 13 releases, with a median interval of about 38 minutes, indicating active recent publishing but also a bursty history that provides limited evidence of long-term maintenance.
There are no open issues or pull requests, but there was also no issue or pull-request activity in the last month; this is neutral-to-weak evidence for a young package rather than proof of active community maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.