The beta release includes detailed notes, a strong README, and repository tests. Maintenance has paused over the last three months, while every workflow action is unpinned and one inherits secrets. Pin this exact beta only for testing, not production.
60%
Total Score
50
63
50
Only one account has registry publish access, which limits publishing redundancy; the linked repository is user-owned rather than organization-owned, so there is no shown organizational backing to offset that thin base.
The package is mature at about 902 days old with 44 releases, but only 2 releases appeared in the last 12 months, indicating a slower recent cadence.
The repository recorded 0 commits and 0 active maintainers in the last three months, despite the latest release being recent, leaving current maintenance capacity uncertain.
The repository uses Composer, but no security-scanning tools were detected. This is a transparency and maintenance gap rather than evidence that the package is unsafe.
The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
league/csv Version ^9.0 | — | — |
halaxa/json-machine Version ^1.2 | — | — |
phpoffice/phpspreadsheet Version ^5.0 | — | — |
woocommerce/action-scheduler Version ^3.7 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.