imponeer/extensions-setup-contracts
The MIT license, matching repository, focused dependency set, and release notes provide useful transparency for this small interface package. Composer and Dependabot tooling are in place, but workflow hygiene and recent activity warrant closer review.
66%
Total Score
83
100
94
75
Health Score Breakdown
The repository recorded zero commits and zero active maintainers in the last three months. This is partly offset by the June 2026 release and July push, but it still indicates limited recent development activity.
The repository has no published security policy. For a small contracts package this is a transparency gap, though it is less serious than for a package handling credentials or sensitive data.
Version v0.2.3 is not a prerelease and recent releases contain no prerelease versions, although the 0.x major version indicates an API that may still evolve.
All three workflows were analyzed with no untrusted checkout or script-injection findings, but all eight action references are unpinned and the auditor found a high-confidence bot-conditions issue in the pull-request workflow. These are meaningful workflow hygiene risks even without a dangerous trigger.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Raimondas Rimkevičius |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 imponeer/extension-info-contracts Version ^0.5 | — | — |
imponeer/log-data-output-decorator Version ^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 3 months ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.