ometra/caronte-sdk
This release appears healthy and suitable to depend on: it is actively released, currently stable, not deprecated, backed by a non-archived organization-owned repository, and shows substantial recent commit and pull-request activity. The package includes extensive documentation, tests, a changelog, and a coherent source tree; its two active contributors and organizational backing reduce the risk associated with a single registry maintainer. The main limitations are low public repository popularity and incomplete security-process hygiene, including no security policy, no security scanning tooling, and no explicit top-level workflow token permissions, but these are mitigated by the absence of analyzed dangerous workflow patterns and by strong recent maintenance evidence.
88%
Total Score
100
100
89
70
Health Score Breakdown
A post-autoload-dump lifecycle script is present. This is a normal integration point for Composer packages, but it warrants review of the script because install-time execution expands dependency-installation behavior.
The repository has zero stars, forks, and watchers, so there is little public adoption evidence. This is supporting evidence only and is outweighed here by active releases, commits, merged pull requests, tests, and organizational backing.
Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a security-hygiene gap, though it does not outweigh the package's strong maintenance evidence.
No repository security policy was found, reducing transparency for vulnerability reporting and response expectations.
The analyzed CI workflow lacks top-level token permissions, so least-privilege automation is not explicitly declared. No workflow has top-level write permissions, which partially limits the concern but does not remove the hygiene gap.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Gabriel Ruelas |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 lcobucci/jwt Version ^5.3 | — | — |
lcobucci/clock Version ^3.2 | — | — |
laravel/prompts Version ^0.3.7 | — | — |
equidna/bee-hive Version ^3.1 | — | — |
laravel/framework Version ^12.0 || ^13.0 | — | — |
Weekly Downloads
Info
- Last Published
- 15 days ago
- Created
- 7 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.