Usable with caveats: the release is licensed, clearly packaged, tested in the repository, and not deprecated or archived. However, the registry has had no new release for nearly six years and the repository shows no commits or issue activity in the last three months, so ongoing maintenance is uncertain.
58%
Total Score
50
100
88
88
The registry namespace and repository are owned by the same individual account, which provides a clear ownership link but no organizational backing to offset a thin maintenance structure.
The package has 57 releases and a long history, but its latest registry release was nearly six years ago and it had no releases in the last 12 months. This materially raises maintenance and compatibility risk.
There were zero commits and zero active maintainers in the last three months. Even though the repository is not archived, this is direct evidence of currently absent development activity.
The repository has 21 open issues and 3 open pull requests, but recorded no new or closed issues and no merged pull requests in the last three months. This supports the concern that maintenance is currently inactive.
Composer is used as a build tool, but no security scanning tools were detected. The missing scanning is a modest transparency gap, while the build tooling itself is appropriate for this package.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nesbot/carbon Version >=1.14 <3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.