The package has one publisher and declares 11 runtime dependencies, all development tools, increasing upkeep and integration risk. It is stable and not deprecated, but its long inactivity makes adoption a liability.
35%
Total Score
50
50
67
The last release was in March 2017, with no releases in the past 12 months, despite the package being over 10 years old. This is strong evidence of abandonment risk.
The package declares 11 runtime dependencies, all appearing to be PHP development and quality-analysis tools, creating an unusually heavy and potentially mismatched runtime dependency surface.
Only one account has registry publish access, leaving the package dependent on a thin publisher base and increasing continuity risk when combined with its inactive release history.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ovr/phpsa Version * | — | — |
phpmd/phpmd Version * | — | — |
phploc/phploc Version * | — | — |
pdepend/pdepend Version * | — | — |
phpunit/phpunit Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.