The project has clear documentation, repository tests, a matching source tree, and a recent stable release. All 11 workflow actions are unpinned, no security policy is published, and there have been no commits in three months.
67%
Total Score
75
94
50
The package has existed since February 2022 and has nine releases, but only one release appeared in the last 12 months with a median interval of about six months. The recent v4.0.0 release partly offsets the slow cadence.
The repository recorded zero commits and zero active maintainers in the last three months. The recent release provides some counterevidence, but current maintenance capacity is still unclear.
No security policy is published in the repository, leaving vulnerability reporting expectations unclear for a dependency intended for application use.
The workflow audit completed cleanly with no untrusted checkouts or injection findings, but all 11 action references are unpinned. This is a reproducibility and maintenance hygiene gap rather than a severe risk on its own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/finder Version 7.*|8.* | — | — |
illuminate/http Version 12.*|13.* | — | — |
illuminate/queue Version 12.*|13.* | — | — |
illuminate/config Version 12.*|13.* | — | — |
illuminate/events Version 12.*|13.* | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.