Its small public footprint and limited security documentation leave less evidence for long-term support. The package is established and actively released, while organization backing and repository tooling provide some reassurance.
61%
Total Score
63
50
94
67
The repository recorded 0 commits and 0 active maintainers in the last three months. Although the recent push and registry releases show the project is not clearly abandoned, this weakens confidence in ongoing source maintenance.
Sixteen runtime dependencies, including the Windwalker and LYRASOFT components, make the application dependent on a broad supporting stack. This increases maintenance surface but is consistent with the package's full-framework application role.
The package runs post-autoload-dump and post-create-project-cmd scripts during Composer operations. These are relevant supply-chain exposure points, but their presence is expected for a create-project application scaffold and is not by itself evidence of poor health.
There are only 3 open issues and no new or closed issues or pull requests in the last month. The low issue load is not inherently negative, but it adds little evidence of active community maintenance.
The repository has 1 star, 7 forks, and 5 watchers, indicating a small public footprint. Popularity is supporting evidence rather than a verdict, but the low visibility provides little independent assurance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
lyrasoft/luna Version ^2.2 | — | — |
windwalker/dom Version ^4.0 | — | — |
windwalker/orm Version ^4.0 | — | — |
windwalker/srp Version ^1.0 | — | — |
windwalker/core Version ^4.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.