Its five-file artifact is easy to inspect and has no install-time scripts. Use facebook/xhp-lib instead of this release.
12%
Total Score
0
58
75
Packagist marks the package abandoned and explicitly names facebook/xhp-lib as the replacement, making this release unsuitable for a new dependency.
The package has only one release, published in April 2014, with no releases in the last 12 months; this indicates prolonged abandonment rather than active maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the package's long-standing lack of releases.
No declared license or license file was found, leaving the legal terms for using the package unclear.
The linked repository has no security policy. This is a transparency gap, though the package's more serious abandonment evidence already drives the assessment.
We didn't find any vulnerabilities for this package.
No maintainer information available.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.