javanile/cron-expression
The repository still has tests and the package has a clear MIT license, while dependencies and install scripts are modest. The missing security policy and high-confidence unpinned container image add maintenance and build-hygiene concerns.
46%
Total Score
100
64
75
Health Score Breakdown
The package is about 5 years old, with no releases in the last 12 months and all 17 releases clustered on one day in 2021. This is strong evidence of limited ongoing maintenance.
The assessed version is v3.1.0, but the registry records v2.3.1 as the latest version. That inconsistency makes the release history and version provenance difficult to interpret.
Composer is used for builds, but no security scanning tool was detected. The missing scanning is a hygiene gap rather than evidence of unsafe code.
The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for consumers.
The workflow audit completed successfully and found no untrusted checkout or script-injection path, but it identified a high-confidence unpinned container image and all four action references are unpinned.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Chris Tankersley |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 webmozart/assert Version ^1.7.0 | — | — |
Weekly Downloads
Info
- Last Published
- 5 years ago
- Created
- 14 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.