Healthy and actively maintained, with strong documentation, frequent releases, and substantial recent repository activity. Dependence is somewhat concentrated in one maintainer, and installation scripts plus a missing security policy warrant review before adoption.
82%
Total Score
70
100
100
63
The package runs post-install and post-update Composer scripts, which increase installation-time behavior and deserve review before use, although the repository otherwise shows mature build and release structure.
Only one account has registry publish access, which creates publishing continuity risk, though repository activity shows multiple recent contributors and the owner remains active.
The repository is owned by an individual rather than an organization, so the concentrated contributor and registry maintainer base is more consequential for long-term continuity.
Commit activity is highly concentrated: one contributor made about 93% of recent commits, despite two other contributors remaining active, leaving a meaningful single-maintainer continuity risk.
The repository has no published security policy, reducing transparency about vulnerability reporting and response procedures.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
paragonie/sodium_compat Version ^1.20 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.