Clear licensing, tests, release notes, and repository security practices provide useful transparency. The large dependency surface and fully unpinned workflow actions add maintenance and build-integrity overhead.
61%
Total Score
50
50
100
83
The repository recorded 0 commits and 0 active maintainers in the last 3 months. This is a significant maintenance warning, especially for a platform with a large dependency surface.
The package declares 49 runtime dependencies across PHP extensions, Composer packages, and frontend assets. This broad dependency surface increases upgrade and compatibility burden.
There were 9 new pull requests but 0 merged pull requests in the last month, alongside 137 open issues. This suggests unresolved maintenance demand, although issue activity alone does not prove abandonment.
The only workflow was fully analyzed with no reported audit findings or untrusted-code sinks. However, all 4 of 4 action references are unpinned, leaving avoidable build-integrity exposure.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-28508 idno/known is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.6.3. | 0.0.0 - 1.6.3 | Critical |
CVE-2026-28507 idno/known is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.6.4. | 0.0.0 - 1.6.4 | High |
CVE-2026-26273 idno/known is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 1.6.2. | 0.0.0 - 1.6.2 | Critical |
CVE-2022-32115 idno/known is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.3.1. | 0.0.0 - 1.3.1 | Medium |
CVE-2022-30852 idno/known is vulnerable to Authorization Bypass Through User-Controlled Key in versions 0.0.0 - 1.3.1. | 0.0.0 - 1.3.1 | Medium |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
mf2/mf2 Version 0.5.0 | — | — |
psr/log Version ~3.0 | — | — |
twig/twig Version 3.18.0 | — | — |
ramsey/uuid Version ^4.1 | — | — |
idno/torophp Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.