The project has a long release history, an organization backing it, and a documented security policy. Its workflows use nine unpinned actions and one has broad write permissions, while recent repository activity is quiet.
68%
Total Score
67
100
94
100
The repository recorded zero commits and zero active maintainers during the last three months. Recent releases and a push shortly before collection partly offset this, but the missing commit activity is a maintenance concern.
There was one new pull request in the last month but no merged pull requests or closed issues, alongside 54 open issues and 12 open pull requests. This indicates limited recent issue throughput.
The project uses Make and Composer for builds, but no security-scanning tools were detected. The separate security policy and workflow audit provide some compensating transparency.
All three workflows were analyzed with no audit findings, no untrusted checkouts, and no script-injection counts. However, all nine action references are unpinned and one workflow grants top-level write permissions, creating moderate workflow hygiene concerns without a demonstrated untrusted sink.
| Title | Versions | Severity |
|---|---|---|
CVE-2022-23598 laminas/laminas-form is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 3.1.0 - 3.1.1, 3.0.0 - 3.0.2 and 0.0.0 - 2.17.1. | 0.0.0 - 2.17.13.0.0 - 3.0.23.1.0 - 3.1.1 | Medium |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
psr/container Version ^1.1.2 | — | — |
laminas/laminas-filter Version ^2 | — | — |
laminas/laminas-stdlib Version ^3.20.0 | — | — |
laminas/laminas-escaper Version ^2 | — | — |
laminas/laminas-hydrator Version ^4.16.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.