The README, tests, release notes, and security policy give consumers useful project context. Its small, young project has limited evidence of continued maintenance, and all four workflow actions are unpinned.
64%
Total Score
50
100
83
100
The package is only about 16 weeks old and has two releases, both within roughly 34 hours. That shows an initial release push but provides little long-term maintenance evidence.
The repository recorded no commits and no active maintainers in the last 3 months. For a package only about 16 weeks old, this is limited evidence of ongoing maintenance.
The repository has 8 stars and no forks or watchers. This is modest supporting evidence and does not by itself indicate an unhealthy package.
Composer build tooling is present, but no security scanning tools were detected. That is a maintenance and assurance gap, not evidence that the release is unsafe.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, injections, or audit findings. However, all four action references are unpinned, leaving avoidable build-integrity exposure.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nesbot/carbon Version ^2.72|^3.0 | — | — |
illuminate/support Version ^10.0|^11.0|^12.0|^13.0 | — | — |
illuminate/database Version ^10.0|^11.0|^12.0|^13.0 | — | — |
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.