It has clear licensing, a matching repository, organization backing, and a security policy. The stable package is lightweight, but its release history and current commit activity show a long maintenance gap; all three workflow actions are unpinned.
62%
Total Score
75
100
88
100
The package has 12 releases since December 2018, but no releases in the last 12 months and its latest release was about two years and eight months ago, indicating a substantial maintenance gap.
The repository recorded zero commits and zero active maintainers in the last three months, indicating current development activity has stalled.
There are no open issues but six open pull requests, with no issues or pull requests merged in the last month; the unmerged PR backlog is a modest maintenance concern.
Composer is used for builds, but no security scanning tools are reported, leaving a tooling gap that is relevant but not independently severe.
All three workflows were analyzed with no injection sinks or high-severity findings, but all three use unpinned actions; this weakens build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
flarum/core Version ^1.2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.