The package has a useful README, tests, release notes, an MIT license, and Dependabot coverage. Its one-person project has little visible adoption and no recent development, while workflow dependencies are not pinned.
58%
Total Score
50
86
75
One registry maintainer is consistent with the linked repository being owned by one user, but it provides little redundancy if that person becomes unavailable.
The latest release was published about 21 months ago, and there were no releases in the preceding 12 months despite 11 releases overall. This indicates a meaningful maintenance concern, though the project has an established release history.
The repository had 0 commits and 0 active maintainers during the last 3 months, consistent with the long release gap. This raises abandonment risk even though the repository is not archived.
The repository has 0 stars, 0 forks, and 1 watcher. Popularity is only supporting evidence, but these counts provide no meaningful external evidence of broad adoption or community support.
The repository has no security policy. This is a minor transparency gap for a library that parses user-provided files, but it is not severe enough to make the release unfit on its own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/yaml Version ^7.1.6 | — | — |
phpoffice/phpspreadsheet Version ^2.2.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.