honed/infolist
The package is clearly licensed and the repository is active under an organization, with tests and release notes available. Its install hook and absent security policy add modest operational caution.
62%
Total Score
75
100
100
50
Health Score Breakdown
A post-autoload-dump install-time script adds execution during dependency installation, creating a modest supply-chain and operational concern.
All three recent commits came from one contributor. Organization backing provides some handoff capacity, but current maintenance remains concentrated.
Three commits in the last three months show ongoing activity, though the pace is light and provides only limited evidence of sustained maintenance.
The repository has no published security policy, leaving vulnerability-reporting expectations unclear for users of this library.
All 12 analyzed action references are unpinned, and one high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; three workflows also grant top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Joshua Wallace |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 honed/core Version ^0.55.0 | — | — |
illuminate/support Version ^12.0||^13.0 | — | — |
illuminate/contracts Version ^12.0||^13.0 | — | — |
inertiajs/inertia-laravel Version ^1.2||^2.0||^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.