Usable with caveats: the release is licensed, documented, backed by a matching organization repository, and not deprecated or archived. However, it has had no release or repository commit activity for over three years, with no security policy or scanning, so verify compatibility before adopting it.
58%
Total Score
75
100
83
83
The package has 29 releases but none in the last three years, with the latest release on February 9, 2023. This is a meaningful maintenance concern for a framework bundle, despite its previously established release history.
There were no commits and no active maintainers in the last three months. Combined with the release-history gap, this indicates that maintenance has effectively stopped or slowed substantially.
The repository has two open issues and no issues or pull requests were opened or closed in the last month. This is modest evidence of an inactive project, though the small issue count limits its severity.
The repository has zero stars, two forks, and six watchers. Low popularity is only supporting evidence and does not outweigh the stronger maintenance signals, but it offers little additional confidence.
Composer build tooling is present, but no security scanning tools are configured. The missing scanning is a transparency and maintenance gap, not evidence that the package is unsafe by itself.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
contao/core-bundle Version ^3.5.1 || ~4.1 | — | — |
heimrichhannot/contao-formhybrid Version ^3.1 | — | — |
heimrichhannot/contao-be_explanation Version ^1.0.7 | — | — |
contao-community-alliance/composer-plugin Version ~2.4 || ~3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.