The repository includes tests, a changelog, security scanning, and a clear Apache-2.0 license. Same-day releases and no commits in the last three months limit evidence of sustained maintenance, while all four workflow actions are unpinned.
66%
Total Score
75
86
50
The package is only 0 days old, with five releases arriving on the same day and a median interval of 0 days. That shows active initial publishing but provides little evidence of an established maintenance cadence.
The repository reports 0 commits and 0 active maintainers over the last three months. Because the package is brand new, this is partly explained by its age, but sustained maintenance remains unproven.
The repository has no security policy. This is a modest transparency gap for a database library, though the reported Psalm scanning provides some compensating security practice.
v5.0.0 is a stable major release rather than a prerelease, but 80% of recent releases were prereleases, so the release history still suggests an evolving project.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all 4 action references are unpinned, leaving avoidable dependency-integrity risk.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.