The package is clearly licensed and its repository matches the package, with a consumer-facing README and security policy. Its workflow references are all unpinned, adding a smaller reproducibility concern to an otherwise inactive project.
18%
Total Score
50
64
88
The package has 31 releases since 2019, but none in the last 12 months; its latest release was on May 31, 2023. The earlier release history shows maturity, but does not offset the prolonged halt.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the archived state and indicating no current maintenance capacity.
The linked repository is archived, and its last push was on May 31, 2023. An archived source project is a severe abandonment risk for a dependency.
The registry profile identifies a stable major line, which supports maturity, although the assessed version is labeled v4.0.0-alpha2 and the recorded latest version is v2.3.9, making this release profile less straightforward.
All 11 analyzed action references are unpinned, which weakens build reproducibility. No dangerous trigger-and-sink combination or high-confidence audit finding was reported, so this is a smaller hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.1 | — | — |
symfony/yaml Version ^5.0 | — | — |
symfony/http-kernel Version ^5.0 | — | — |
symfony/translation Version ^5.0 | — | — |
symfony/event-dispatcher Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.