Tests, a README, and organization ownership provide useful support for adoption. The custom license declaration has no accompanying license file, while all nine workflow actions are unpinned and one uses an archived action.
55%
Total Score
75
86
67
The manifest declares LicenseRef-NetCommons, so the release is licensed, but no license file was detected in either the package or repository, limiting transparency.
The package has 23 releases since August 2016, but none in the last 12 months and its latest release was in October 2023, indicating a prolonged maintenance gap.
The repository had zero commits and zero active maintainers in the last three months, which reinforces the release-history concern and raises abandonment risk.
The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.
Both workflows were analyzed successfully with no dangerous trigger or untrusted checkout findings, but all 9 action references are unpinned and a high-confidence medium-severity archived-action finding remains.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
netcommons/boxes Version @dev | — | — |
netcommons/pages Version @dev | — | — |
netcommons/rooms Version @dev | — | — |
cakedc/migrations Version ~2.2 | — | — |
netcommons/blocks Version @dev | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.