The small dependency set, matching repository, license, release notes, and non-archived project support adoption. Workflow permissions are broad and action references are unpinned, while the repository has no security policy.
67%
Total Score
50
100
88
75
The package has existed for about six years with nine releases, but it has had no release in roughly one year. That suggests slower maintenance, though the latest release includes documented bug-fix notes.
The repository recorded no commits and no active maintainers in the last three months. Combined with the absence of recent releases, this is a meaningful maintenance concern.
The repository uses Composer for builds, but no security scanning tools were detected. For a small extension this is a hygiene gap rather than evidence of abandonment.
No security policy is present in the repository, reducing transparency about vulnerability reporting and response.
Both workflows grant top-level write permissions and all four action references are unpinned, which weakens workflow hygiene. The audit found no untrusted checkouts, injection sinks, or other high-confidence dangerous findings.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
flarum/core Version ^1.8 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.