Repository tooling and organizational backing are reassuring. Pin this version while the project’s release cadence remains uncertain and workflow references stay unpinned.
68%
Total Score
75
100
94
100
The package has 44 releases over more than nine years, but it has had no registry release in about 13 months, which weakens evidence of ongoing publishing activity.
There were no commits and no active maintainers in the last three months, a meaningful maintenance concern that is partly offset by the recent repository push and established release history.
The sole workflow was fully analyzed with no detected injection or high-severity findings, but all four action references are unpinned, leaving avoidable build-integrity risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
automattic/vipwpcs Version ^3.0.0 | — | — |
slevomat/coding-standard Version ^8.13 | — | — |
phpcsstandards/phpcsextra Version ^1.1 | — | — |
phpcsstandards/phpcsutils Version ^1.0 | — | — |
phpcompatibility/php-compatibility Version ^9.3.5 || ^10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.