Usable with caveats: it is actively released, clearly licensed, and backed by a matching organization repository with tests. The package ships without a README, and all recent commits come from one contributor, which increases maintenance and integration risk.
72%
Total Score
83
81
50
The published library artifact has no README, so consumers get little integration guidance directly from the package. The source repository does contain a README and tests, which partly offsets the documentation gap but does not remove it from the released artifact.
One contributor made all 16 commits in the last three months, leaving no demonstrated backup maintainer. Organization backing provides some handoff capacity, but the observed contributor concentration remains a maintenance risk.
The repository uses Composer for builds, but no security-scanning tools were detected. The build setup is present, while security-process transparency is limited.
The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, though it is not evidence that the package is unsafe.
Version 0.44.1 is not a stable-major release, so the public API may still change before a 1.0 release. It is not a prerelease and recent releases show no prerelease usage, limiting the concern.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
psr/clock Version ^1.0 | — | — |
flow-php/types Version self.version | — | — |
google/protobuf Version ^4.0 || ^5.0 | — | — |
flow-php/telemetry Version self.version | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.