The source was updated for this release but has had no commits in the past three months. Its repository does not name this package in the README, and all five workflow actions are unpinned.
20%
Total Score
50
71
75
The registry marks the entire package as abandoned, with no clear deprecation message and a replacement pointing to the same package name. This is a severe adoption risk despite recent release evidence.
The package has existed for about 11 years with 28 releases, but only one release appeared in the last 12 months. That indicates substantially reduced recent maintenance.
The linked repository recorded zero commits and zero active maintainers in the past three months. The recent release and push provide some compensating evidence, but current development activity is absent.
The repository name does not match the package name and its README does not mention this package, so the source may not clearly belong to the published package.
The workflow audit completed cleanly with no dangerous triggers, sinks, or findings, but all five action references are unpinned. That leaves the build exposed to unexpected action changes.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/http-foundation Version ^6.4||^7.4||^8.0 | — | — |
phpoffice/phpspreadsheet Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.