graph_curd/api
The package has a usable README and a straightforward Composer source tree, with no install-time scripts or registry deprecation. Its single-person ownership, absent security policy, and minimal repository activity leave substantial maintenance and transparency risk.
36%
Total Score
25
69
83
Health Score Breakdown
The manifest declares the package proprietary, but no license file was detected in the package or repository. This leaves the terms for dependency use unclear.
The package is about 6 years and 9 months old but has only 3 releases, all clustered within minutes on 18 December 2019, with no releases in the last 12 months. This is strong evidence of abandonment risk.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the release history showing no activity since 2019. The long inactivity materially lowers confidence in ongoing maintenance.
Only one registry publishing maintainer is listed, and the project backing identifies an individual owner rather than an organization. This creates a thin publishing and continuity base.
Composer build tooling is present, which supports reproducible package structure, but no security-scanning tooling was detected. The missing scanning is a modest hygiene gap rather than evidence of unsafe behavior.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 gkfsunshine |
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 6 years ago
- Created
- 6 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.