The repository is not archived, matches the package, and was pushed recently, but there have been no registry releases in over four years and no recent commit activity. The license declaration also conflicts with the license file, so pinning this abandoned package is a poor choice.
18%
Total Score
50
50
58
75
The registry marks the entire package as abandoned and names phuongdev89/yii2-roxymce as a replacement. This is a severe adoption risk even though the linked repository remains available.
The latest registry release was over four years ago, with no releases in the last 12 months. Its 19-release history shows past activity but does not offset the current release gap.
The package declares nine runtime dependencies, including several frontend assets and required PHP extensions. This adds maintenance surface but is consistent with a Yii2 editor and file-manager extension.
The artifact declares MIT while its license file is detected as BSD-3-Clause; both the artifact and repository contain license files, so this is a real metadata mismatch rather than an absence of licensing.
The repository had zero commits and zero active maintainers in the last three months. A recent repository push provides some continuity, but not evidence of ongoing maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
bower-asset/tinymce Version ^4.3 | — | — |
bower-asset/fancybox Version ~2.1 | — | — |
bower-asset/fontawesome Version ^5 | — | — |
bower-asset/jquery.lazyload Version ~1.9 | — | — |
navatech/yii2-navatech-base Version @dev | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.