The four releases arrived within about two hours, and the repository has had no commits from maintainers for three months. The package is clearly licensed, documented, tested in the repository, and not deprecated, but its short history leaves limited evidence of sustained maintenance.
60%
Total Score
75
100
86
50
The package is only 143 days old and all four releases were published within about two hours, so there is little evidence of an established release cadence. Its recent release count is positive but does not offset the very short history.
The repository recorded zero commits and zero active maintainers during the last three months. For a package only 143 days old, that leaves a meaningful uncertainty about ongoing maintenance.
Composer build tooling is present, but no security-scanning tools were detected. The missing scanner is a hygiene gap rather than evidence that the package is unsafe to depend on.
The repository has no security policy, reducing transparency about how vulnerabilities should be reported. This is a maintenance and disclosure gap, not a severe risk by itself.
The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. Both action references are unpinned, which is a supply-chain hygiene weakness but not a severe risk on its own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/support Version ^10.0|^11.0|^12.0 | — | — |
illuminate/database Version ^10.0|^11.0|^12.0 | — | — |
illuminate/contracts Version ^10.0|^11.0|^12.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.