Clear documentation, repository tests, licensing, and a security policy help. Workflow references are all unpinned, and one high-confidence bot-condition finding adds maintenance hygiene risk.
65%
Total Score
50
100
89
75
A post-autoload-dump install lifecycle script runs during Composer installation, adding some execution surface for consumers, although this signal alone does not establish unsafe behavior.
One registry maintainer account publishes the package. Because the repository owner is an individual rather than an organization, the narrow publishing base modestly increases continuity risk.
The registry namespace and repository are owned by the same individual account, so the package has clear ownership but no demonstrated organizational backing.
This is the package's only release, published 160 days ago, so release continuity is not yet demonstrated.
The package has only one release in its 160-day lifetime, leaving its long-term maintenance pattern unproven.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/serializer Version ^6.4||^7.2||^8.0 | — | — |
illuminate/contracts Version ^10.0||^11.0||^12.0||^13.0 | — | — |
web-auth/webauthn-lib Version ^5.2 | — | — |
symfony/property-access Version ^6.4||^7.2||^8.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.