kafka-bus/laravel-bridge v1.5.0 shows active registry release cadence (9 releases in the last 12 months; median ~4 days) and the source repository is not archived with recent pushes and merges, suggesting ongoing maintenance. However, maintenance is concentrated in a single active contributor (repo_bus_factor and repo_commit_activity both indicate full concentration), and the repo lacks a published security policy. Additionally, the packaged artifact signal indicates no bundled tests (even though the source repo has tests), which slightly increases adoption risk around CI parity. Overall this is usable, but you should weigh the single-maintainer/small-team risk and security-policy gap before depending on it broadly.
66%
Total Score
75
86
75
An install-time lifecycle script is present (post-autoload-dump), which is usually limited in scope, but it still means extra code may execute during Composer operations.
The registry lists only 1 maintainer, matching the single-contributor development signal and reinforcing a thin maintenance coverage story.
The artifact includes README and CHANGELOG, and the repo has tests (repo_has_tests true), but the artifact-level signal indicates has_tests=false, suggesting tests may not be included in the published distribution.
All recent commits appear to come from a single contributor (top_contributor_commit_share=1.0; contributor_count_3_months=1), which increases bus-factor risk if that person becomes unavailable.
Repository popularity counters are currently 0 for stars/forks/watchers, which is not a direct health failure but provides limited community adoption evidence for faster external auditing.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
kafka-bus/core Version ^1.3 | — | — |
kafka-bus/commiter Version ^1.2 | — | — |
kafka-bus/messages Version ^1.0 | — | — |
illuminate/contracts Version ^10.0 || ^11.0 || ^12.0 || ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.