Usable with caveats: the package is licensed, documented, tested in its repository, and backed by an organization, but recent maintenance activity is absent and repository workflow security hygiene is incomplete. Review the project before adopting it for a critical dependency.
62%
Total Score
67
100
88
63
The sole workflow contains one detected script-injection pattern, creating avoidable risk in repository automation even though no pull_request_target or untrusted-checkout workflow was found.
The package has 9 releases over about 807 days and 2 releases in the last 12 months. Releases continue, but the relatively low recent cadence limits evidence of active maintenance.
The repository recorded zero commits and zero active maintainers in the last 3 months. Although a release and push occurred on March 23, 2026, the lack of recent commit activity raises maintenance and abandonment concerns.
There are 3 open issues, with no issues or pull requests opened or closed in the last month. This provides little evidence that reported problems are being actively handled.
Composer build tooling is present, but no security scanning tools were detected, leaving a gap in automated security hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
javaabu/forms Version ^1.67 | — | — |
maatwebsite/excel Version ^3.1 | — | — |
illuminate/support Version ^10.0 || ^11.0 || ^12.0 || ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.