This is a healthy, actively maintained release with a strong release cadence, stable versioning, current repository activity, clear licensing, source/artifact alignment, tests, and no deprecation or install-time lifecycle scripts. The main concerns are that all recent repository commits come from one contributor, the repository has minimal external adoption, and no security scanning or security policy was observed; organizational ownership provides some maintenance backing but does not eliminate the single-contributor risk. Overall, it appears reasonable to depend on, with normal supply-chain due diligence recommended.
78%
Total Score
70
100
89
90
Only one registry publishing account is listed, which is a limited publishing redundancy; the linked repository is organization-owned and the package has substantial recent release activity, partly compensating for this administrative concentration.
All 14 recent commits came from one contributor, creating a genuine continuity risk. Organization ownership provides some ability to hand off maintenance, but no second active contributor is shown.
There were no new or closed issues or pull requests in the last month, and open issue count is unknown; this provides little evidence of community support, though the active release and commit signals compensate for part of the gap.
The repository has only 1 star and 0 forks, so external adoption and independent validation appear limited; popularity is supporting evidence, so this warrants caution rather than a severe penalty.
Composer build tooling is present, but no security scanning tools were detected; the missing scanning reduces assurance about ongoing repository hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
masterminds/html5 Version ^2.7 | — | — |
symfony/dom-crawler Version ^6.0 | — | — |
symfony/css-selector Version ^6.0 | — | — |
getpop/component-model Version ^19.2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.