The package has a declared BSD-3-Clause license, a matching source repository, and no install-time scripts. Its README remains an untouched template, while the single release was 740 days ago and the repository shows no recent commits, tests, security policy, or community activity.
43%
Total Score
25
100
67
83
There has been only one release, and no release in the 740 days since the initial publication. That leaves little evidence of ongoing maintenance for a package intended as a reusable module.
The repository has had zero commits and zero active maintainers in the last three months, consistent with the package having stopped after its only release. This is a substantial abandonment concern.
A README is present, but its 6,260-character content is still the default GitLab setup template rather than package documentation. Missing tests and a changelog are normal for the published artifact and are not treated as gaps here.
The registry namespace is hesabro, but the linked repository is owned by an individual user rather than an organization. This provides limited visible project backing for a package published under that namespace.
The repository name matches the package name, but the README does not mention the package. That weakens the evidence that the repository is intentionally documented as the source for this release.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
yiisoft/yii2 Version ~2.0.14 | — | — |
hesabro/helpers Version ^1.0 | — | — |
yiisoft/yii2-mongodb Version ^2.1 | — | — |
yiisoft/yii2-bootstrap4 Version ^2.0 | — | — |
kartik-v/yii2-widget-select2 Version @dev | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.