The project has had no commits in the last three months and its workflow leaves all three actions unpinned. It does have a current release, tests, licensing, and organization backing, but those strengths do not offset the adoption risk.
42%
Total Score
75
81
50
The package is flagged as borrowing the identity of laravel/pint, with borrows_lookalike_identity true and no self-described fork; this is strong evidence consumers may have wanted the other package.
The package has existed for about 5 years and has 16 releases, but only 1 release in the last 12 months indicates a slow current cadence.
The repository recorded 0 commits and 0 active maintainers in the last three months, leaving current maintenance capacity unproven despite a recent release.
The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities.
The single analyzed workflow has no untrusted trigger or audit finding, but all 3 of its action references are unpinned, so dependencies can change without a reviewed workflow update.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/pipeline Version ^11.0|^12.0|^13.0 | — | — |
illuminate/contracts Version ^11.0|^12.0|^13.0 | — | — |
laravel-json-api/core Version ^5.3 | — | — |
laravel-json-api/validation Version ^4.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.