Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.
63%
Total Score
caution
A one-day-old 0.x release has active development but 34 of 35 workflow actions are unpinned.
The package is only 1 day old, with 6 releases clustered over that period; this shows active initial development but provides little evidence of sustained maintenance.
Version 0.2.0 is not a stable major release, so its APIs and behavior may still change. The absence of a large prerelease share is mildly reassuring but does not offset the early maturity stage.
The repository analyzed both workflows successfully, with no untrusted checkouts or script injection, but 34 of 35 action uses are unpinned and a high-confidence finding identifies an unpinned tool version. Low-confidence cache findings are hygiene concerns rather than severe evidence on their own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
revolt/event-loop Version ^1.0.9 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.