mwguerra/interactive-upgrader
The package includes a useful README, tests, and matching MIT licensing. Its single-maintainer project has limited release and security-process support, so future fixes and oversight may be slow.
55%
Total Score
50
81
50
Health Score Breakdown
A post-autoload-dump install-time script adds execution surface during dependency installation. Its presence alone is not severe, but it warrants some caution for supply-chain hygiene.
Only two releases exist, both from May 2025, with no releases in the last 12 months. That is a meaningful maintenance concern for a dependency intended to track Composer and npm changes.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and increasing abandonment risk.
Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency and maintenance-process gap rather than a severe risk.
The repository has no published security policy, leaving vulnerability-reporting expectations unclear. The package's small scope and available tests provide limited compensation.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Marcelo Guerra |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 composer/semver Version ^3.4 | — | — |
symfony/console Version ^7.0 | — | — |
symfony/process Version ^7.0 | — | — |
composer/composer Version ^2.8 | — | — |
guzzlehttp/guzzle Version ^7.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.