The package is documented, MIT-licensed, and backed by repository tests, release notes, and security tooling. Its workflows also contain a high-confidence concern about archived action use and a medium-confidence actor-condition warning.
8%
Total Score
0
57
100
Packagist marks the entire package as abandoned, with no replacement specified. Package-level deprecation is a severe adoption risk because future fixes and compatibility work are not signaled.
The latest release was published nearly 7 years ago, with no releases in the last 12 months and only three releases overall. This indicates prolonged inactivity and substantial abandonment risk.
The repository recorded no commits and no active maintainers in the last 3 months. The archived status and long release gap reinforce that this is not merely a temporarily quiet project.
The linked repository is archived and was last pushed over 6 years ago. This strongly indicates the project is no longer maintained, outweighing its otherwise useful historical documentation.
All five workflows were analyzed with no untrusted checkout or script-injection findings, but every action reference is unpinned and the audit found archived action use with high confidence plus a medium-confidence bot-condition issue. These are additional maintenance and workflow-hygiene concerns.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ergebnis/classy Version ~0.5.0 | — | — |
league/factory-muffin Version ^3.0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.