The MIT license, tests, and README provide useful transparency. However, the last release and repository push were nearly three years ago, with no commits or release activity in the past three months; unpinned workflow actions and no security policy add maintenance concerns.
43%
Total Score
25
100
78
50
The latest release was nearly three years ago, and there were no releases in the last 12 months. That is a significant abandonment concern despite the package having 56 releases overall.
There were zero commits and zero active maintainers in the past three months, consistent with the long release gap and indicating little current maintenance capacity.
A post-autoload-dump install-time script adds execution complexity during installation and warrants caution, though the signal alone is not evidence of an unsafe package.
The repository is owned by an individual rather than an organization, so the small two-account registry maintainer list has limited backing to compensate for the inactivity.
The repository has zero stars, forks, and watchers, providing no supporting evidence of an active user or contributor community. Popularity is only supporting evidence, so this reinforces rather than establishes the risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
predis/predis Version ^1.1 | — | — |
illuminate/http Version ~5.4|~6.0|~7.0|~8.0|~9.0|~10.0 | — | — |
illuminate/console Version ~5.4|~6.0|~7.0|~8.0|~9.0|~10.0 | — | — |
illuminate/support Version ~5.4|~6.0|~7.0|~8.0|~9.0|~10.0 | — | — |
illuminate/contracts Version ~5.4|~6.0|~7.0|~8.0|~9.0|~10.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.