This is a well-scaffolded, actively published release with a permissive MIT license, tests, changelog, clear package documentation, a complete-looking 37-file tree, no install-time lifecycle scripts, stable 1.4.0 versioning, and a repository that is neither archived nor mismatched to the package. The main concerns are that the project is very young at 36 days, all six recent commits come from one contributor, and the repository has no security scanning or security policy; these reduce resilience and transparency but do not outweigh the otherwise strong packaging and recent maintenance evidence. The organization backing provides some continuity, though the single-contributor concentration remains a real adoption risk.
78%
Total Score
75
100
83
90
Six releases over 36 days with a median interval of about 7 days show active early development, although the short history provides limited evidence of long-term maintenance.
One contributor made all six commits in the last three months, creating a genuine continuity risk. Organization ownership offers some potential handoff capacity, but no second active contributor is shown to compensate for the concentration.
Six commits were made in the last three months, showing ongoing work, but the activity is limited in volume and concentrated in the short project history.
The repository has zero stars, forks, and watchers; this is weak supporting evidence, but popularity is not decisive for a young, specialized package.
The repository uses Make and Composer build tooling, but it has no security scanning configured; the missing scanning is a modest transparency gap rather than evidence of unsafe behavior.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
symfony/validator Version ^7.0 || ^8.0 | — | — |
symfony/http-kernel Version ^7.0 || ^8.0 | — | — |
symfony/dependency-injection Version ^7.0 || ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.