mellivora/framework
The stable version, MIT license, and release notes provide basic usability and transparency. The missing security policy and post-update script add smaller concerns.
32%
Total Score
0
75
50
Health Score Breakdown
The package has only 2 releases, with the latest published in September 2017 and none in the last 12 months. This long period without releases is strong evidence of abandonment for a framework dependency.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with its last push in October 2017. This leaves little evidence of ongoing maintenance.
The package defines a post-update-cmd lifecycle script, which can execute automatically during dependency updates. This adds installation and update complexity, although the signal does not show that the script is unsafe.
The linked repository name does not match the package name, and its README does not mention the package. That makes package-to-source ownership less transparent and raises uncertainty about whether the repository is the correct project.
No security policy was found in the linked repository. For a web framework, this reduces transparency around vulnerability reporting and maintenance expectations.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 zhouyl |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 mellivora/mellivora Version dev-master | — | — |
Weekly Downloads
Info
- Last Published
- 9 years ago
- Created
- 9 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.