lockally/sdk
The package has substantial documentation, tests, organizational ownership, and read-only workflow permissions. Its licensing metadata conflicts with the detected MIT license, and the workflows use unpinned actions, so pinning this early release deserves care.
58%
Total Score
67
71
75
Health Score Breakdown
The artifact and repository contain a license file, but the manifest declares Unlicense while the detected file is MIT. The package is licensed, yet the mismatch reduces clarity for adopters.
This is a 48-day-old package with only one published release. That limits evidence of release stability and long-term maintenance.
One contributor made 100% of the two recent commits. Organizational ownership provides some handoff capacity, but no second active contributor is shown.
Only two commits were recorded in the last three months. Recent activity exists, but the small volume provides limited evidence of sustained maintenance.
Composer build tooling is present, but no security scanning tools were detected. For a young SDK, the missing scanning is a modest transparency and maintenance gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 OpenAPI |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 guzzlehttp/psr7 Version ^1.7 || ^2.0 | — | — |
guzzlehttp/guzzle Version ^7.3 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 1 month ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.