The repository includes tests, a changelog, release notes, a clear MIT license, and a security policy. Its small runtime dependency set and matching repository improve transparency, but the project provides limited evidence of sustained activity.
58%
Total Score
38
100
81
83
The package has only three releases, with the latest published roughly 14 months after the observed first release and no releases in the last 12 months. That weakens evidence of ongoing registry maintenance despite the short early release interval.
The repository recorded zero commits and zero active maintainers over the last three months. Combined with no registry releases in the last 12 months, this is strong evidence that maintenance may have stalled.
The package runs a post-autoload-dump install-time script. This is a small integration consideration, but the signal provides no evidence that the script is unsafe or unusually broad.
One registry publishing account is recorded. The linked repository is user-owned rather than organization-backed, so the single-account setup provides limited redundancy.
The source repository is owned by an individual rather than an organization, so there is no provided evidence of institutional backing or a broader maintenance team.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/contracts Version ^11.0||^12.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.