Documentation and tests make integration clearer, and the source tree matches the package. The lack of activity leaves maintenance and compatibility concerns for a production dependency.
40%
Total Score
25
50
79
83
The latest release was published in July 2015, and there have been no releases in roughly 11 years. This is strong evidence of abandonment for a maintained library.
The repository recorded no commits and no active maintainers in the last three months, consistent with the package's roughly 11-year release silence.
The package declares nine runtime dependencies for its upload, storage, and UI features. This is a meaningful dependency surface for an unmaintained package, though the count alone is not severe.
The source repository is owned by an individual rather than an organization. This does not prove abandonment, but it provides limited backing to offset the long period without activity.
Composer build tooling is present, but no security scanning tooling was detected. That weakens ongoing transparency, especially alongside the repository's prolonged inactivity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
league/url Version ~3.0 | — | — |
yiisoft/yii2 Version ~2.0.0 | — | — |
league/flysystem Version ~1.0 | — | — |
yiisoft/yii2-jui Version ~2.0.0 | — | — |
bower-asset/jcrop Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.