Clear documentation, release notes, and security tooling improve transparency. The install-time script deserves a closer look before automated deployment.
70%
Total Score
67
93
83
A post-install command runs during installation, creating additional execution surface that should be understood before allowing automated installs.
Only one registry account can publish releases. This is a resilience concern, although the repository shows that the maintainer is actively contributing.
One contributor made all 68 recent commits, creating a high bus-factor risk for continuity if that person becomes unavailable.
Version 0.5.0 is pre-1.0, so the project may still introduce breaking changes even though it is not marked as a prerelease.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0.2 | — | — |
doctrine/dbal Version ^4 | — | — |
symfony/finder Version ^6.4 || ^7.0 || ^8.0 | — | — |
typo3/cms-core Version ^13.4 || ^14.3 | — | — |
symfony/ai-mate Version ^0.13 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.