eloquent/composer-config-reader
The MIT license, release notes, README, and repository tests provide good transparency. Workflow references are entirely unpinned and include a high-confidence template-injection warning, adding operational risk.
12%
Total Score
0
40
50
Health Score Breakdown
Packagist marks the entire package as abandoned, with no replacement specified. This is a direct warning against taking a new dependency on the package.
The latest release was published nearly six years ago, with no releases in the last 12 months. The long release gap materially increases abandonment risk.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's abandoned status.
The source repository is archived, and its last push was over three years ago. Archived source strongly indicates that maintenance and fixes should not be expected.
Both analyzed action references are unpinned, and the workflow has a high-confidence template-injection finding. The template issue is hygiene rather than proof of compromise, but it adds avoidable maintenance and build risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Erin Millard |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 eloquent/enumeration Version ^6 | — | — |
justinrainbow/json-schema Version ^5 | — | — |
Weekly Downloads
Info
- Last Published
- 5 years ago
- Created
- 13 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.