The package has a clear MIT license, useful README, tests, release notes, and no install-time scripts. Its small maintainer base and workflow hygiene leave less operational reassurance for a dependency that has otherwise gone quiet.
55%
Total Score
50
100
88
75
One registry publishing account is listed. That is a limited publishing base for a user-owned project and provides little redundancy if the maintainer becomes unavailable.
The source repository is owned by an individual account rather than an organization, so the single registry maintainer does not have visible organizational backing to compensate for the thin maintainer base.
The package has 39 releases over about five years, but its latest registry release was more than two years ago and it had no releases in the last 12 months. That is a meaningful maintenance concern.
The repository recorded zero commits and zero active maintainers in the last three months, indicating that source maintenance has currently stopped.
There were no new or closed issues or pull requests in the last month, while seven pull requests remain open, suggesting limited current project follow-through.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
tcg/voyager Version ^1.4|dev-1.6-l10 | — | — |
joy/voyager-core Version ^1.0|^2.0|^3.0 | — | — |
maatwebsite/excel Version ^3.1 | — | — |
illuminate/support Version ^7|^8|^9|^10 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.