This is a generally healthy and usable release: it has been maintained for over three years, has 14 releases including three in the last 12 months, is on a stable major version, is not deprecated, and is backed by an active, non-archived repository that matches the package and includes tests, CI, licensing, and a substantial source tree. The main risks are operational rather than signs of abandonment: all four recent commits came from one contributor, the repository has low popularity, no security policy or automated security scanning, and its workflow does not declare top-level token permissions. The artifact omits packaged tests and a changelog, but repository tests and the detailed README partly compensate for those gaps.
78%
Total Score
75
50
89
80
The package has 10 runtime dependencies, including platform extensions and multiple libraries; this is a meaningful dependency surface but is coherent with an SVG/Twig integration package and is not by itself excessive.
The repository is owned by a user account rather than an organization, so the concentrated contributor activity is not supported by visible organizational backing.
All 4 commits in the last 3 months came from one contributor, creating a genuine single-maintainer continuity risk for this user-owned project.
The repository has only 4 stars, 0 forks, and 1 watcher. This is weak supporting evidence for community adoption, but popularity alone is not a health verdict.
Composer build tooling is present, but no security-scanning tools are configured, leaving a security-hygiene gap that is partly mitigated by the repository's otherwise structured build setup.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
twig/twig Version ^2.7|^3.0 | — | — |
masterminds/html5 Version ^2.0 | — | — |
iconify/json-tools Version ^1.0 | — | — |
ocubom/base-convert Version ^2.0|^3.0 | — | — |
symfony/options-resolver Version ^5.4|^6.0|^7.0|^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.