The package is clearly documented, licensed, and its release includes notes and repository tests. The maintained-looking organization context does not offset the lack of current project activity and withdrawal status.
15%
Total Score
50
100
50
75
Packagist marks the entire package as abandoned, with no replacement named. Package-level deprecation is a severe adoption risk even though it does not by itself prove maliciousness.
The package has a substantial history of 167 releases since September 2017, but it had no releases in the last 12 months despite a prior median interval of about 7 days. That sharp cessation indicates abandonment risk.
There were zero commits and zero active maintainers in the last 3 months. This confirms that the current lack of releases reflects absent repository activity rather than merely a packaging delay.
The linked hhvm/hhast repository is archived, and its last push was on May 4, 2024. An archived source project is a strong indicator that ongoing maintenance is no longer expected.
There are 36 open issues and 4 open pull requests, but no issues or pull requests were opened or closed in the last month. The unresolved backlog reinforces the lack of active maintenance.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
facebook/difflib Version ^1.0.0 | — | — |
hhvm/type-assert Version ^4.2.2 | — | — |
facebook/hh-clilib Version ^2.5.0rc1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.