Organization backing, a clear license, tests, release notes, and a security policy support adoption. Maintenance is concentrated in one contributor, with no security scanning and little issue activity, so pin this version and monitor the repository.
62%
Total Score
63
100
83
100
The package has 163 releases and historically released about every eight days, but no registry release has appeared for roughly five years. That is a meaningful maintenance and abandonment concern.
All two recent commits came from one contributor, concentrating current maintenance risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.
The repository recorded two commits in the past three months, showing recent activity but at a very low pace for a large ecommerce system.
Only four issues are open, but there were no new or closed issues and no pull-request activity in the past month. This suggests limited visible maintenance.
Composer is used for builds, but no security-scanning tool was detected. For a large ecommerce application, that is a meaningful transparency and maintenance gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ramsey/uuid Version * | — | — |
yiisoft/yii2 Version >=2.0.40 | — | — |
geoip2/geoip2 Version 2.10.0 | — | — |
league/iso3166 Version ^2.1 | — | — |
facebook/graph-sdk Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.