It includes tests, a README, release notes, and explicit license files. Its workflow leaves all eight actions unpinned, adding avoidable release-process risk.
18%
Total Score
50
50
56
67
The package has a substantial history of 287 releases, but it has had no release in the last 12 months and its latest registry release was in November 2023. This indicates the release line is no longer actively maintained.
The repository recorded zero commits and zero active maintainers during the last 3 months. Combined with the archived state, this is strong evidence that maintenance has stopped.
The linked source repository is archived, making the project unfit for a new dependency despite its recorded push in June 2026. Archived status is a severe abandonment signal.
The release declares 69 runtime dependencies and 20 development dependencies, creating a broad maintenance and update surface. This is consistent with a full enterprise distribution but increases dependency-management burden.
The package runs post-install and post-update Composer scripts. These add installation-time execution risk and deserve review, although the signal alone does not establish unsafe behavior.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/flex Version ^1.7 | — | — |
symfony/form Version ^5.0 | — | — |
symfony/yaml Version ^5.0 | — | — |
symfony/asset Version ^5.0 | — | — |
symfony/cache Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.