The package is well documented, licensed, tested in the repository, and has no runtime dependencies or install scripts. Workflow references are not pinned and the project lacks a security policy, so ongoing dependency risk remains.
68%
Total Score
50
100
86
67
The repository is owned by an individual user rather than an organization, so there is no visible organizational handoff capacity to offset the concentrated contributor base.
This is a young package with one release in the past 41 days and no established release cadence yet. That limits evidence of long-term maintenance, but does not by itself indicate abandonment.
All two recent commits came from one contributor, leaving maintenance concentrated in a single person and increasing continuity risk.
The repository recorded two commits in the last three months, showing some activity, but the small volume provides limited evidence of sustained maintenance.
Composer build tooling is present, but no security scanning tool was detected. The missing scanning is a modest transparency and maintenance gap for a package intended for dependency use.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.