The package has clear documentation, a changelog, matching source repository, and an organization behind it. Its small maintainer base, absent security scanning, and two unpinned workflow actions leave more maintenance and build-hygiene risk than a mature dependency.
61%
Total Score
63
50
89
83
Ten runtime dependencies create a meaningful dependency surface for a web and LTI integration package, but the profile is coherent with the package's stated functionality and is not excessive enough to indicate a severe concern.
Only one account has registry publish access, which creates a thin publishing base. The organization-backed repository provides some compensation, so this is a caution rather than a severe risk.
There were no commits and no active maintainers in the last 3 months, indicating a recent pause in development. This raises abandonment risk despite the repository not being archived.
There are 5 open issues and 2 open pull requests, with no new or closed items in the last month; unresolved work combined with current inactivity is a maintenance caution.
The repository has zero stars, forks, and watchers, so there is little external adoption evidence. Popularity is only supporting evidence, and the organization backing and matching repository provide some compensation.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
slim/http Version ^1.4 | — | — |
slim/slim Version ^4.12 | — | — |
odan/session Version ^6.4 | — | — |
php-di/php-di Version ^7.0 | — | — |
psr/container Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.