Packaging is clear, licensed, and tested, with organization ownership behind it. The long maintenance pause and unpinned workflow actions make a current dependency a cautious choice.
57%
Total Score
75
50
88
75
The package declares 10 runtime dependencies and 3 development dependencies, including several related project components. This is a substantial integration surface but is plausible for a Spryker REST API module.
The package has made no releases in the last 12 months, and its latest release was about 18 months ago. Its six releases over roughly two years show an established release history but do not offset the current pause.
There were zero commits and zero active maintainers in the last three months, consistent with an approximately 18-month maintenance pause. The organization-backed, non-archived repository softens this to a maintenance concern rather than severe abandonment risk.
The repository uses Make and Composer, but no security scanning tools were detected. The build tooling is positive, while the missing scanning is a modest transparency and maintenance gap.
No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
spryker/company Version ^1.0.0 | — | — |
spryker/company-user Version ^1.0.0 || ^2.0.0 | — | — |
spryker/uuid-behavior Version ^1.0.0 | — | — |
fond-of-oryx/erp-order Version ^4.8.0 | — | — |
spryker/glue-application Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.