The package has had no release in the last 12 months and no commits in the last 3 months. It includes tests and remains unarchived, but its single-maintainer model, broad dependency set, and absent security tooling increase ongoing maintenance risk.
52%
Total Score
50
50
81
50
The package declares 44 runtime dependencies, including many extensions and internal packages, creating a broad compatibility and maintenance surface for adopters.
Only one registry account has publishing access. The linked repository is user-owned rather than organization-owned, so there is no provided backing evidence to offset the thin maintainer base.
The artifact and repository contain tests, which is a small positive. The package has no README or changelog; the missing README reduces consumer guidance for a library package.
The package has three releases over about three years, with no releases in the last 12 months; this indicates a substantially slowed maintenance cadence.
There were zero commits and zero active maintainers in the last 3 months, directly supporting the concern that development has paused.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
phpunit/phpunit Version ^10.0.0 | — | — |
tomsgu/pdf-merger Version ^0.5.0 | — | — |
gamboa.martin/test Version ^5.0.0 | — | — |
spatie/dropbox-api Version ^1.19 | — | — |
gamboa.martin/banco Version ^17.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.