Documentation, tests, and release notes make integration clearer. Its one-release history, no commits in the last three months, and workflow hygiene leave meaningful maintenance and build-trust concerns.
62%
Total Score
50
88
50
This is the package's only release, published 227 days ago, so there is limited evidence of release maturity or sustained maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, weakening evidence of ongoing maintenance after the initial release.
The repository uses Make and Composer for builds, but no security scanning tooling was detected, leaving a modest transparency and assurance gap.
No security policy was found in the repository, reducing clarity about vulnerability reporting and response.
The single workflow was fully analyzed with no dangerous trigger or script-injection findings, but all 13 action references are unpinned and high-confidence archived-uses and artipacked findings weaken build reproducibility and credential hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
apache/avro Version dev-main#c499eefb48aa2db906c7bca14a047223806f36db | — | — |
beberlei/assert Version ~2.7|~3.0 | — | — |
guzzlehttp/psr7 Version ^2.4 | — | — |
guzzlehttp/guzzle Version ^7.0 | — | — |
guzzlehttp/promises Version ^2.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.