This is a usable but young package with several positive supply-chain indicators: it is MIT-licensed, on a stable non-prerelease major version, not deprecated, has a small runtime dependency surface, no install lifecycle scripts, and is backed by an active-looking organization-owned repository that matches the package and references it in the README. However, the package is only 169 days old, its six releases were published in rapid succession, and the repository reports no commits or active maintainers in the last three months despite a recent push. The absence of tests, a changelog, security scanning, and a security policy reduces transparency and assurance. It is reasonable for adoption with normal dependency review, but it is not yet a mature, strongly validated dependency.
68%
Total Score
67
100
78
90
A substantial README documents the package, but neither the artifact nor repository contains tests or a changelog. For a young framework integration, this leaves meaningful validation and release-history gaps.
The package is only 169 days old with six releases, all within the last 12 months, and the median interval is about 26 minutes, indicating rapid early iteration rather than established release maturity.
The repository reports zero commits and zero active maintainers in the last three months, which is a material maintenance concern. The recent push and release activity provide some compensation, so this is caution rather than a severe abandonment finding.
There are no open issues or pull requests and no issue or pull-request activity in the last month. This avoids an unresolved backlog, but also provides little evidence of community review or maintenance engagement.
The repository has zero stars, forks, and watchers. This is weak supporting evidence for maturity, but popularity is not decisive for a small, specialized package.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
lara-igniter/framework Version ^1.51 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.