The MIT license, stable version, and GitHub release provide basic transparency. Install scripts and a repository that does not identify this package add integration and ownership concerns.
56%
Total Score
75
50
75
50
Nine runtime dependencies include testing and static-analysis tools such as PHPUnit, PHPStan, Psalm, and PHP-CS-Fixer, making the package's runtime dependency surface unusually broad for a testing utility.
post-install-cmd and post-update-cmd scripts run during Composer operations, adding execution and integration complexity for consumers.
This package has only one release, published about 360 days ago, so there is little history from which to judge sustained maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, indicating no recent maintenance signal.
The repository name does not match the package name and its README does not mention this package, so the linkage is less transparent even though a subpackage mismatch can be ordinary.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
vimeo/psalm Version ^6 | — | — |
phpstan/phpstan Version ^2 | — | — |
phpunit/phpunit Version ^12 | — | — |
symfony/console Version ^7.3 | — | — |
friendsofphp/php-cs-fixer Version ^3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.