This release is usable but presents meaningful maturity and maintenance risk. It is a stable, non-deprecated package with a clear BSD-3-Clause license, substantial source-tree tests, documentation, changelog, and no install-time lifecycle scripts; the repository also matches the package and has been pushed recently. However, the project is only 97 days old, has released six times in a very short period, shows zero commits and zero active maintainers over the last three months, has no observed popularity or issue activity, is maintained by one registry publisher, and lacks security scanning and a security policy. These factors make it a reasonable candidate for controlled use, but not yet a high-confidence dependency for critical systems.
62%
Total Score
50
100
83
90
Only one account has registry publish access. This is a limited operational base and increases concentration risk, although it does not by itself establish poor maintenance.
The repository is owned by an individual user rather than an organization, so there is no organizational backing signal to offset the package's single-maintainer concentration.
The package is only 97 days old and has six releases, with a median interval of about 12 hours; this shows active initial publishing but provides little evidence of long-term stability and is unusually release-dense.
The repository records zero commits and zero active maintainers in the last three months. Although the repository was pushed recently and the package has had recent releases, the lack of observed commit activity is a significant maintenance-continuity concern.
There are no open issues or pull requests and no issue or pull-request activity in the last month. This is not inherently unhealthy for a young package, but it offers no evidence of an active user or contributor community.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.