The release includes focused documentation, tests, a matching MIT license, and a repository that clearly belongs to the package. Its small maintainer base, quiet recent commit activity, absent security policy, and unpinned workflow actions leave meaningful maintenance and build-reproducibility concerns.
72%
Total Score
50
92
67
The registry namespace and repository owner match, but the project is owned by an individual rather than an organization. This is consistent ownership evidence but offers limited backing capacity.
The package has existed since 2013, but only one release appeared in the last 12 months and the median release interval is about 439 days. The latest release is recent, which partly offsets the slow cadence.
There were no commits and no active maintainers in the last three months. The recent release provides some evidence of ongoing support, but current maintenance capacity appears limited.
The repository has no security policy. This is a transparency and incident-handling gap, though it is not evidence that the package is unsafe.
The sole workflow was fully analyzed with no detected sinks or audit findings, but all three action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions weaken build reproducibility.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
doctrine/dbal Version ^2.4 || ^3.0 | — | — |
phpunit/phpunit Version ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.0 || ^12.0 | — | — |
matthiasnoback/phpunit-test-service-container Version ^3.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.