The package has clear documentation, tests, a changelog, an MIT license, and a small runtime dependency surface. Its release history is concentrated in a few hours, and there have been no commits or active maintainers in the last three months; a post-install script and absent security policy add modest concerns.
62%
Total Score
50
100
79
67
The repository recorded zero commits and zero active maintainers during the last three months. For a package that is about 6 months old, this is a meaningful sign that maintenance may have stopped after launch.
The package defines a post-install command. Install-time execution increases dependency-installation complexity and deserves review, although the signal does not show that the script is harmful.
One registry account has publishing access. The linked repository is organization-owned, which provides some backing context, but the registry still shows a narrow publishing base.
All five releases were published within roughly 4 hours and 20 minutes, with a median gap of about 33 minutes. This shows an initial publishing burst but not sustained release activity across the package's 192-day lifetime.
There are no open issues or pull requests, and no issue or pull-request activity in the last month. This is neutral for a small new project because it may simply have little usage, but it provides no evidence of an active support loop.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.