Usable with caveats: it is actively developed, well documented, tested, licensed, and backed by a non-archived organization repository. However, the package is only 49 days old, releases are extremely frequent, and all recent commits come from one contributor, so its long-term stability and continuity are not yet proven.
72%
Total Score
70
100
78
90
Only one registry account has publish access. That is a continuity concern, although the linked repository is owned by an organization, which provides some organizational backing rather than relying solely on an individual.
The package is only 49 days old but has 65 releases, with a median interval of about 3 hours 22 minutes. This shows strong activity but leaves limited evidence of long-term stability and suggests unusually rapid iteration.
One contributor made all 76 recent commits, creating a low practical bus factor. Organization ownership provides some ability to hand off maintenance, but no second active contributor is shown to demonstrate that capacity.
There were 76 commits in the past three months, all from one active maintainer. The volume is strong, but the single-person concentration limits continuity if that contributor becomes unavailable.
The repository has zero stars, forks, and watchers. Given that the project is only 49 days old, this is weak supporting evidence rather than a severe health problem.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
milpa/core Version >=0.12 <1.0 | — | — |
milpa/http Version >=0.2 <1.0 | — | — |
milpa/live Version >=0.18 <1.0 | — | — |
nyholm/psr7 Version ^1.8 | — | — |
milpa/plugin Version >=0.13 <1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.