This is a healthy but very young package with strong evidence of active development and reasonable project transparency. It has four releases in 31 days, a stable 1.0.0 release, a non-deprecated registry status, a linked non-archived repository, substantial recent commit and pull-request activity, repository tests, documentation, licensing, security scanning, and a security policy. The main concerns are that the package is only 31 days old, nearly all recent commits come from one contributor, and its post-install lifecycle script and incompletely declared GitHub Actions permissions warrant review. These concerns reduce maturity and resilience but do not outweigh the clear maintenance activity and repository hygiene.
82%
Total Score
70
100
89
80
A post-install-cmd script executes during installation, creating additional supply-chain and reproducibility surface that a developer should inspect before adoption.
Only one registry account has publish access, which is a resilience concern, although registry access records do not establish actual development capacity and the repository shows multiple active contributors.
The repository is owned by an individual user rather than an organization, so the highly concentrated commit activity and single registry maintainer represent genuine continuity concerns rather than normal organizational publishing hygiene.
Four releases in 31 days with a median interval of about 3 days show active early development, but the package's short 31-day history provides limited evidence of long-term maintenance.
Although three contributors were active, one contributor made about 98.7% of the 305 recent commits. This creates a substantial continuity risk for a user-owned project without organizational backing.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
doctrine/dbal Version ^4.0 | — | — |
typo3/cms-core Version ^13.4.0 || ^14.3.6 | — | — |
psr/http-message Version ^1.0 || ^2.0 | — | — |
typo3/cms-backend Version ^13.4.0 || ^14.3.6 | — | — |
psr/event-dispatcher Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.