Clear licensing, tests, release notes, and recent publishing provide useful support. Maintenance activity is currently concentrated in one contributor, while the workflow audit found a high-confidence bot-condition issue.
68%
Total Score
67
94
75
All recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown in this period.
Only one commit from one active maintainer was recorded in the last three months, indicating limited recent maintenance capacity despite the healthy release history.
The assessed release is not a prerelease and recent prerelease share is zero, supporting release stability, although the reported latest version being older than 3.0.2 is an inconsistency.
All five workflows were analyzed and all action references are pinned, with no untrusted checkout or script-injection findings. However, a high-confidence bot-condition issue and one workflow with top-level write permissions reduce workflow hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
filament/filament Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.