The package is well documented, tested, actively changed, and has a minimal runtime dependency surface. Its beta status, concentrated contributor base, absent security policy, and unpinned workflow actions warrant monitoring before relying on it broadly.
72%
Total Score
63
100
88
75
Only one registry maintainer has publish access. This is consistent with the individual-owned repository, but it leaves limited publishing redundancy if that maintainer becomes unavailable.
The registry namespace and repository are owned by the same individual account, so the package has direct ownership alignment but no organizational backing indicated by the collected evidence.
Two contributors were active, but the leading contributor made about 93% of recent commits. That concentration creates a meaningful continuity risk for this individually owned project.
Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency and maintenance gap rather than evidence of an unsafe release.
The repository has no security policy. For a library handling typed RPC between a backend and frontend, this reduces clarity about vulnerability reporting and response expectations.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.