The README clearly explains the package's library-development role, and its tiny artifact fits a dependency metapackage. Releases have been quiet for about 17 months, all recent versions are pre-releases, and installation runs update scripts. The repository could not be found, limiting verification of maintenance and provenance.
55%
Total Score
50
80
75
This development-tools metapackage declares 10 runtime dependencies, including testing, linting, and static-analysis tools. The contents fit its purpose, but the broad runtime dependency surface makes updates and transitive risk harder to manage.
The package runs both post-install and post-update scripts. These may be appropriate for a development-tools metapackage, but they add install-time behavior that increases operational risk for consumers.
The package has 10 releases over about six years but none in the last 12 months; this indicates limited recent maintenance, though the package may only need occasional updates.
The latest version is a pre-release and all recent versions are pre-releases, while the README explicitly says the package does not follow semver. That makes dependency upgrades less predictable.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
phpmd/phpmd Version ^2 | — | — |
phpro/grumphp Version ^1 | — | — |
phpunit/phpunit Version ^6 || ^7 || ^8 || ^9 | — | — |
nikic/php-parser Version ^4 | — | — |
sebastian/phpcpd Version ^3 || ^4 || ^5 || ^6 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.