The project is organization-backed, licensed, documented, and has repository tests and release notes. It is only 143 days old, has one release, and recorded no commits in the last three months, limiting evidence of sustained maintenance.
42%
Total Score
83
100
78
100
The package borrows the identity of launchdarkly/server-sdk, which has 86 stable releases and about 442,817 monthly downloads versus this package's single release and 71 downloads. Even with zero artifact overlap, this creates a substantial risk that consumers may select the wrong package.
This package is 143 days old and has only one release, so there is little release history from which to judge long-term maintenance or stability.
The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed 2 months ago, the recent activity snapshot provides weak evidence of ongoing development.
Version 0.1.0 is an initial non-stable-major release, indicating an immature API and limited compatibility history.
All five workflows were analyzed with no reported findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, five of seven action references are unpinned and one workflow grants top-level write permissions, creating a modest reproducibility and permissions hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0|^2.0|^3.0 | — | — |
open-telemetry/api Version ^1.0 | — | — |
launchdarkly/server-sdk Version ^6.8 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.