The package is well documented, tested, licensed, and has a minimal dependency footprint. Its single-maintainer base, absent security policy, and lack of recent commits leave maintenance capacity and review practices limited.
58%
Total Score
50
100
75
75
There were no commits and no active maintainers in the last three months. Combined with no releases since 2021, this is meaningful evidence of slow or paused development.
A post-autoload-dump install-time script is present. This adds execution during installation and deserves review, but the signal alone does not establish unsafe behavior.
One registry maintainer is listed, while the repository is organization-owned; that ownership partly compensates for the short registry maintainer list, but the observed publishing base is still narrow.
Only two releases were published, with none in the last 12 months; the latest release was in September 2021, indicating a long period without release maintenance.
There are no open issues and one open pull request, with no issues or pull requests merged in the last month; this provides little evidence of active community maintenance.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.