It has a clear MIT license, README, tests, and release notes, with no install scripts. Security coverage is limited by no security policy and all six workflow actions being unpinned.
52%
Total Score
50
83
75
This is the only release, published 424 days ago, with no releases in the last 12 months. That leaves maintenance and compatibility uncertain.
The repository had zero commits and zero active maintainers in the last 3 months, reinforcing the lack of recent maintenance evidence.
The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.
Version v0.1.0 is not a stable major release, so its API may change substantially if development resumes.
All six referenced actions are unpinned, and the audit found a high-confidence template-injection issue; with no untrusted checkout or risky trigger identified, this is workflow hygiene rather than a severe dependency risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
saloonphp/saloon Version ^3.14 | — | — |
hosmelq/sse-saloon Version ^0.1.0 | — | — |
thecodingmachine/safe Version ^3.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.