The repository is well documented, tested, licensed, and backed by an organization with a security policy. Recent maintenance is sparse and concentrated in one contributor, while repository security scanning is not configured.
68%
Total Score
67
75
100
The package has 35 releases since January 2017 and a release on September 1, 2026, but only one release in the last 12 months compared with a historical median interval of about 12 days. This indicates a marked slowdown without showing abandonment.
All recent commits come from one contributor, leaving no demonstrated second active contributor to provide continuity. Organization backing partly reduces the handoff risk but does not remove the concentration concern.
Only one commit was made in the last 3 months by one active maintainer. The recent release shows the repository is not abandoned, but this is still light current maintenance.
Composer build tooling is present, but no security scanning tool was detected. This is a hygiene gap, not evidence that the release is unsafe, especially because a security policy is present.
Version 0.7.0.3 is not a stable major version, but it is not marked as a prerelease and recent releases have no prerelease share. The versioning is therefore a modest maturity concern rather than a release blocker.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0 | — | — |
locomotivemtl/charcoal-core Version ~0.4 | — | — |
locomotivemtl/charcoal-config Version ~0.10 | — | — |
locomotivemtl/charcoal-object Version ~0.7 | — | — |
locomotivemtl/charcoal-factory Version ~0.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.