Usable with caveats: the package is licensed, documented, tested, stable, and backed by a matching organization repository. However, it has had no release or commit activity for over four years and has almost no community adoption, so future compatibility and maintenance are uncertain.
62%
Total Score
63
100
83
90
One registry publisher is consistent with the organization-backed project, but the small publishing base provides limited redundancy if that maintainer becomes unavailable.
The package has seven releases since September 2020, but none in the last four years; this strongly lowers confidence that compatibility fixes or maintenance updates will arrive.
There were no commits or active maintainers in the last three months, consistent with the release history showing no release for over four years and creating a meaningful abandonment risk.
There are no open issues or pull requests and no recent activity. The clean tracker is mildly positive, but it does not show that maintenance work is happening.
The repository has zero stars and forks and only two watchers, indicating very limited external adoption; popularity is supporting evidence, but this adds uncertainty alongside the stale activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-message Version ^1.0 | — | — |
germania-kg/jsondecoder Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.