Documentation, release notes, licensing, and security tooling are strong. Organization backing and active pull-request merging help, but the automation audit found a high-confidence workflow condition concern.
62%
Total Score
83
93
50
The package uses a post-autoload-dump lifecycle script, which adds install-time behavior and a small amount of dependency-installation complexity.
The package was first released today and has 12 releases within the same day, so its maintenance history and maturity are not yet established.
All seven recent commits came from one contributor, leaving a thin observed contributor base; organization backing provides some capacity for handoff but does not show a second active contributor.
All nine workflows were analyzed, use read-only permissions, and pin all 17 action references. However, a high-confidence high-severity bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
filament/filament Version ^4.11.2 || ^5.6.2 | — | — |
livewire/livewire Version ^3.0 || ^4.0 | — | — |
illuminate/support Version ^11.0 || ^12.0 || ^13.0 | — | — |
illuminate/contracts Version ^11.0 || ^12.0 || ^13.0 | — | — |
spatie/eloquent-sortable Version ^4.5 || ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.