It has a complete license, repository tests, release notes, and security scanning. Workflow references are all unpinned, and the audit flags unsafe bot checks and template injection.
10%
Total Score
0
69
50
Packagist marks the entire package as abandoned, with no replacement named. This directly signals that new dependencies should not be placed on it.
The repository had no commits and no active maintainers in the last 3 months, reinforcing the abandonment concern rather than showing active support.
The linked source repository is archived, which prevents normal ongoing maintenance even though it was last pushed in August 2025.
The package has 24 releases since July 2021, but none in the last 12 months. The long median release interval is outweighed by the current lack of releases and the package abandonment status.
All 23 analyzed action references are unpinned, and high-confidence findings flag spoofable bot checks and possible template injection. There are no untrusted checkouts or script-injection findings, so this is a workflow-hygiene concern rather than the main reason for the score.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/container Version ^1.1.2 || ^2.0.2 | — | — |
laminas/laminas-uri Version ^2.13.0 | — | — |
laminas/laminas-router Version ^3.14.0 | — | — |
laminas/laminas-stdlib Version ^3.20.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.