Risky to adopt without confirming the package source and replacement path. Packagist marks this package abandoned, although its linked Yii repository is active, well-tested, and maintained by several contributors.
48%
Total Score
100
81
100
Packagist marks the entire package as abandoned, with no replacement identified, which is a serious dependency and support risk. The linked repository remains active, but that does not remove the registry-level abandonment status for this package.
The registry reports a stable major-version profile and no recent prerelease share, but the assessed version is labeled 3.0.0-alpha1 while the reported latest version is 2.0.55. That version mismatch increases adoption uncertainty.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ~1.0.2 | — | — |
cebe/markdown Version ~1.0.0 | ~1.1.0 | — | — |
psr/http-message Version ~1.0.0 | — | — |
psr/simple-cache Version ~1.0.0 | — | — |
yiisoft/yii2-composer Version ~2.0.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.