Usable with caveats: this is a licensed, stable release from an organization-backed repository with tests, release notes, and no deprecation or install scripts. Maintenance has been quiet recently, with no commits or issue activity in three months, and workflow permissions are not consistently restricted.
72%
Total Score
67
100
88
83
The package has existed for about 6 years 9 months with 73 releases, but only one release was published in the last 12 months. That slower cadence is a maintenance caution for a package whose contents may reasonably change infrequently.
There were zero commits and zero active maintainers in the last three months. The recent repository push and current release provide some compensation, but the lack of ongoing commit activity still lowers confidence in rapid maintenance response.
No issues were opened or closed and no pull requests were merged in the last month, indicating limited recent development activity. This is a caution rather than a severe risk because the package is a small, stable resource collection.
Composer build tooling is present, but no security scanning tool was detected. The absence of scanning reduces transparency around automated security checks, though it is partly offset by the repository's security policy and straightforward package structure.
Two of three workflows lack top-level token permissions, and one workflow requests write access. This is a workflow-hardening gap, although the dangerous-workflow analysis found no untrusted checkout, script injection, or pull-request-target risks.
We didn't find any vulnerabilities for this package.
No maintainer information available.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.