The MIT license, focused dependencies, tests, changelog, and security tooling provide a solid foundation. Maintenance has slowed, and the workflow uses 13 unpinned actions, leaving avoidable supply-chain hygiene gaps.
76%
Total Score
83
100
94
75
The package has 20 releases since July 2017, but it had no registry releases in the last 12 months; the repository push in June 2026 partly offsets, but does not remove, the maintenance concern.
No commits or active maintainers were recorded in the last three months, indicating limited recent development capacity despite the newer repository push.
The repository has no published security policy, a minor transparency gap for reporting vulnerabilities.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all 13 action references are unpinned, leaving a preventable workflow supply-chain hygiene weakness.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.