The repository is not archived and the package has a clear README, stable versioning, and organization backing. However, no releases in about 20 months and no commits in the last 3 months weaken confidence in ongoing maintenance.
61%
Total Score
83
50
83
83
The SDK declares 24 runtime dependencies, which is a relatively broad dependency surface for a library. Many are standard HTTP, PSR, Symfony, and serialization components, partly compensating for the added maintenance exposure.
The package has 30 releases, but none in the last 12 months; its latest release was about 20 months ago. This is a meaningful maintenance concern despite the historically regular median interval of about 19 days.
The repository recorded zero commits and zero active maintainers in the last 3 months. This is the strongest evidence that ongoing maintenance may have slowed or stopped.
The repository has no stars or forks and only one watcher. This provides little external validation, but popularity is supporting evidence and does not outweigh the maintenance signals.
The repository uses Composer, which supports reproducible project builds, but no security scanning tools were detected. That is a hygiene gap rather than evidence of abandonment.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.1 || ^2.0 || ^3.0 | — | — |
symfony/cache Version ^5.4 || ^6.0 || ^7.0 | — | — |
symfony/string Version ^5.4 || ^6.0 || ^7.0 | — | — |
psr/http-client Version ^1.0 | — | — |
php-http/httplug Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.