Clear documentation, tests in the repository, and a matching source project make adoption easier. The recent pause in commits and unpinned workflow actions leave maintenance and build-reproducibility concerns.
68%
Total Score
50
100
94
83
A post-autoload-dump lifecycle script runs during installation, adding execution surface beyond ordinary dependency loading; no provided signal shows it is unsafe.
The registry and repository are owned by the same individual account, making ownership transparent but indicating a single-person project rather than organizational backing.
The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance warning despite the recent push and release history.
Composer is used for the build, but no repository security-scanning tool was detected, leaving automated security coverage unclear.
The single workflow was fully analyzed with no detected dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, so their versions can change without a repository commit.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
filament/forms Version ^4.0|^5.0 | — | — |
spatie/laravel-package-tools Version ^1.15.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.