The repository includes tests, a useful README, and a matching package reference, while the release is licensed and has no install-time scripts. Its short history, one-person commit base, missing security policy, and unpinned workflow actions leave meaningful maintenance and build-integrity concerns.
58%
Total Score
50
88
83
Only one registry maintainer is listed, which is a modest publishing continuity concern for a package without organization backing.
The repository is owned by an individual user rather than an organization, so the single-maintainer and single-contributor concentration is not offset by visible organizational backing.
The package is only 46 days old with four releases, all clustered within roughly two days, so there is little evidence of sustained maintenance or long-term stability.
All four recent commits came from one contributor, leaving maintenance highly dependent on a single person.
Four commits were made in the last three months, but this is limited activity for a new package and does not yet demonstrate sustained maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
flarum/core Version ^1.0 | — | — |
guzzlehttp/guzzle Version ^7.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.