jonnitto/iframe 5.0.0 is a small, long-established and currently usable package: it has existed for over 10 years, has a stable major release, is not deprecated, has a matching source repository that mentions the package, and was recently published. The main concerns are that only one maintainer is listed, repository popularity is very low, there were no commits or active maintainers in the last 3 months, and the project has no tests, security policy, or security-scanning tooling. These issues warrant monitoring and may increase bus-factor and maintenance risk, but the active, non-archived repository and recent release keep it in the caution rather than unhealthy range.
72%
Total Score
63
100
83
90
Only one registry account, Jon Uhlmann, has publishing access. This creates a meaningful publishing bus-factor concern, although the linked repository is also owned by that individual and recent release activity provides some compensation.
A README and GitHub Releases are present, but neither the artifact nor repository contains tests or a changelog. The missing tests and changelog reduce transparency somewhat, although the README documents installation and use.
The repository is owned by an individual account rather than an organization, so there is no organizational backing to reduce the single-owner risk. However, the repository owner is consistent with the package publisher context.
There were zero commits and zero active maintainers in the last 3 months, which is a concrete maintenance-cadence concern. The recently pushed repository and newly released version partly offset this, but do not demonstrate sustained ongoing development.
The repository has 1 star, 0 forks, and 1 watcher. This indicates very limited community adoption or visibility, but popularity is supporting evidence rather than a standalone health verdict.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
neos/neos Version ^8.4 || ^9.0 | — | — |
carbon/eel Version ^2.28 | — | — |
carbon/notification Version ^2.4 || ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.