The registry has had no new release since March 2021, and the repository recorded no commits in the last three months. Documentation, repository tests, licensing, and a non-archived source repository provide useful support, but all three workflow actions are unpinned and no security policy is present.
63%
Total Score
75
100
88
75
The package has 26 releases, but none in the last 12 months and the latest registry release was in March 2021. This materially raises staleness risk, although the long history shows prior maintenance.
The repository recorded zero commits and zero active maintainers in the last three months. This suggests currently slow maintenance, though the recent push recorded by the repository status partly offsets abandonment concerns.
Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.
The repository has no published security policy, leaving vulnerability-reporting expectations unclear for a package that may be used in production.
The single workflow was fully analyzed with no high-confidence findings, dangerous triggers, or broad write permissions. However, all three action references are unpinned, which weakens build reproducibility and workflow supply-chain hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
mikehaertl/php-tmpfile Version ^1.2.1 | — | — |
mikehaertl/php-shellcommand Version ^1.5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.