This is a usable, transparently licensed Laravel package with a stable v5.0.0 release, a matching repository, documented usage, source-level tests, changelog, dependency automation, and no deprecation or archive status. However, maintenance capacity appears thin: the registry has one maintainer, the repository has only 5 stars and no forks, and it recorded zero commits from active maintainers during the last 3 months, despite a recent release and pull-request activity. The absent security policy and undeclared workflow token permissions are additional hygiene concerns, though the analyzed workflow showed no dangerous patterns. Overall, it is reasonable to depend on with normal maintenance and update monitoring, but it does not have strong evidence of sustained activity or broad project backing.
68%
Total Score
63
100
89
80
Only one registry account has publish access. The matching user-owned repository provides identifiable ownership, but the narrow publisher base increases continuity risk if that maintainer becomes unavailable.
The repository is owned by an individual user rather than an organization, so there is no organizational backing signal to compensate for the single-maintainer profile.
The package is about 3 years old with 9 releases and 3 releases in the last 12 months, but a median interval of about 178 days indicates relatively infrequent maintenance.
The repository recorded 0 commits and 0 active maintainers during the last 3 months, a meaningful maintenance warning. The recent release and pull-request activity partially offset this, but do not establish sustained commit activity.
The repository has only 5 stars, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these values provide little external evidence of a broad maintainer or user community.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
laravel/framework Version ^11.44|^12.0|^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.