Its README, license, repository tests, and security policy provide a solid baseline. CI uses all eight actions without pinning, so build provenance is weaker than the project structure suggests.
74%
Total Score
67
100
88
83
A post-autoload-dump script runs during installation, adding install-time behavior that consumers should understand before adoption; the signal does not show that it is harmful.
Only one registry publishing account is listed. The repository is user-owned rather than organization-owned, so the small publisher base provides limited redundancy.
This is the only release, published less than one hour before collection, so there is no evidence yet of sustained release maintenance. Its zero-day age makes the lack of history expected rather than evidence of abandonment.
There were no commits in the prior three months and no active maintainers in that window. Because the repository was created or updated only moments before collection, this is too little history to establish abandonment.
v0.1.0 is an early major version, which signals a less mature compatibility promise even though it is not marked as a prerelease.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
filament/filament Version ^5.0 | — | — |
illuminate/contracts Version ^11.0|^12.0|^13.0 | — | — |
harris21/laravel-fuse Version ^0.10 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.