Clear tests, release notes, and a security policy improve transparency. The package is young, so its long-term maintenance remains unproven.
68%
Total Score
50
100
88
88
Only one registry maintainer is listed. The repository is user-owned rather than organization-owned, so there is no demonstrated organizational publishing backup.
The repository is owned by the same individual namespace as the package, so the source relationship is consistent, but it does not provide organization-level maintenance backing.
There have been two releases over about 31 days, and the package is only 108 days old; this shows initial activity but leaves long-term cadence unproven.
One contributor made 100% of the recent commits. With user ownership and no second active contributor shown, maintenance is dependent on a single person.
Only one commit was recorded in the last three months, all from one active maintainer; for a young package this is limited evidence of ongoing maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
craftcms/cms Version ^5.0 | — | — |
craftcms/commerce Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.