The repository includes tests, security scanning, and pinned workflow actions, while the package has a clear MIT license and no install-time scripts. Its small dependency surface and matching source repository also reduce adoption friction.
68%
Total Score
67
100
86
100
The package and repository are owned by the same individual account rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.
The package is only 56 days old and has two releases, both published close together, so its long-term maintenance pattern is not yet established.
All 18 recent commits came from one contributor, leaving maintenance dependent on a single person and increasing continuity risk.
Version v0.1.1 is an early 0.x release rather than a stable major release, which indicates the API may still change.
All three workflows were analyzed successfully, all 11 action references are pinned, and no audit findings or untrusted checkout or script-injection paths were reported. Two workflows grant top-level write permissions, a mild hygiene concern without an untrusted trigger or sink.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
laravel/framework Version ^11.0||^12.0||^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.