The repository is not archived and the release includes notes, a README, and a matching source project. The GPL declaration differs from the detected GPL-3.0 license, while recent commit activity is absent and workflow references are unpinned.
68%
Total Score
50
100
81
50
The manifest declares GPL-2.0+, while the artifact license file is detected as GPL-3.0; both the artifact and repository contain license files, so this is a clarification issue rather than an unlicensed release.
The registry namespace and repository owner are related but the repository owner is recorded as a user account rather than an organization, so backing appears limited and does not compensate for the thin recent activity.
The package has been published since August 2020 with 26 releases, but only one release appeared in the last 12 months, indicating a slower cadence that merits some caution.
The repository recorded zero commits and zero active maintainers in the last three months. Although the latest release was recently pushed, the short-term activity gap weakens confidence in ongoing maintenance.
There are no open issues and two open pull requests, but no issues or pull requests were merged in the last month, providing limited evidence of active maintenance.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-core Version ^12 || ^13 || ^14 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.