This is a mature, actively released Contao extension with over 11 years of package history, a stable 3.0.0 release, an unarchived repository, current repository activity through pull requests, and clear Composer and Dependabot tooling. The main concerns are that no commits were recorded in the last 3 months, the artifact and repository contain no tests or changelog, and the sole workflow does not declare top-level token permissions; these reduce transparency and maintenance confidence but are not, on the provided evidence, severe enough to make the package unfit to depend on.
72%
Total Score
88
50
89
80
The package has 11 runtime dependencies, including Contao, Symfony, Doctrine, and related extensions. This is a meaningful integration surface and therefore increases upgrade coupling, but the dependencies are consistent with the bundle's stated functionality.
A concise README documents configuration and usage, but neither the artifact nor repository has tests or a changelog. For a small integration bundle this is a genuine transparency and regression-coverage gap.
No commits and no active maintainers were recorded in the last 3 months, which is a maintenance concern. However, the recent release, repository push, and pull-request activity provide partial compensating evidence.
The repository has 0 stars, 2 forks, and 1 watcher. This is weak supporting popularity evidence, but popularity is not decisive for a specialized package.
No repository security policy was found. This is a transparency gap, though it is less significant for a small application bundle than for security-sensitive infrastructure.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
doctrine/dbal Version ^3.10 || ^4.0 | — | — |
symfony/config Version ^6.4 || ^7.4 | — | — |
contao/core-bundle Version ^5.3 | — | — |
symfony/http-kernel Version ^6.4 || ^7.4 | — | — |
hofff/contao-content Version ^4.1.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.