The repository has security policy, tests, release notes, and recent maintenance. One contributor handles all recent commits, and every workflow action is unpinned, so long-term resilience and build reproducibility are weaker.
78%
Total Score
83
94
100
One contributor made all eight recent commits, leaving maintenance highly concentrated; organization backing provides some ability to hand work off but does not remove the current continuity risk.
The repository has zero stars, forks, and watchers, so there is little external adoption evidence to support the project's health, though popularity is only supporting evidence.
All four workflows were analyzed with no untrusted checkouts, script injection, or high-confidence findings. However, all 16 action references are unpinned and one workflow has top-level write permissions, creating reproducibility and least-privilege cautions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0 || ^2.0 || ^3.0 | — | — |
psr/clock Version ^1.0 | — | — |
react/async Version ^4.3 | — | — |
react/cache Version ^1.2 | — | — |
symfony/lock Version ^6.0 || ^7.0 || ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.