Clear documentation, tests, release notes, and organization backing improve adoption confidence. Recent activity is sparse and concentrated in one contributor, while both workflow actions are unpinned.
70%
Total Score
67
88
100
The package has existed for over 11 years and released once in the last 12 months, with a median interval of about 9 months; the recent release helps, but the cadence is modest.
One contributor made all commits in the last 3 months. Organization backing provides some handoff capacity, but no second active contributor is shown in this period.
Only one commit was recorded in the last 3 months, which shows some recent activity but a thin current maintenance pace.
The project uses Make and Composer, but no security-scanning tooling was detected; this is a modest transparency and maintenance gap rather than a severe concern.
The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. Both of its two action references are unpinned, leaving build inputs less reproducible.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
composer/installers Version ^2|^1.0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.