A single maintainer and 240 open issues add abandonment risk. The package remains licensed, tested, documented, and linked to a non-archived repository, which supports continued use with care.
52%
Total Score
25
83
50
The package has had no release in more than 7 years, despite 64 releases overall, indicating that registry maintenance has stopped for this release line.
There were zero commits and zero active maintainers in the last 3 months, strongly indicating that active maintenance has stopped.
There were no new or closed issues and no merged pull requests in the last month, while 240 issues and 23 pull requests remain open; this points to an unattended backlog.
post-install-cmd and post-update-cmd scripts run during Composer operations, adding installation complexity and supply-chain exposure that is not otherwise compensated here.
Only one registry account has publish access. Because the repository is user-owned, this is not inherently abnormal, but it leaves a thin publishing base alongside the inactive project.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0 | — | — |
sabre/uri Version ^2.0 | — | — |
sabre/event Version ^5.0 | — | — |
webmozart/glob Version ^4.1 | — | — |
webmozart/path-util Version ^2.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.