Usable with caveats: this is a stable, non-deprecated metapackage with clear documentation and organization-backed ownership. Release activity is sparse and the linked repository had no commits in the last three months, so production users should prefer the underlying packages as the README recommends.
72%
Total Score
75
50
88
90
The package declares seven runtime dependencies covering the API, SDK, exporters, HTTP client, and PSR-7 implementation; this is substantial dependency surface but matches the documented metapackage purpose.
The package has only 4 releases since March 2023, with 1 release in the last 12 months and a median interval of about 205 days; this indicates a deliberately infrequent release cadence rather than strong ongoing momentum.
There were 0 commits and 0 active maintainers in the last three months, which is a concrete maintenance-momentum concern; the recent push and organization backing provide only partial reassurance.
The repository uses Composer, appropriate for a PHP package, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.
No repository security policy was found, reducing clarity about vulnerability reporting and response expectations.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nyholm/psr7 Version ^1.5 | — | — |
open-telemetry/api Version ^1 | — | — |
open-telemetry/sdk Version ^1 | — | — |
symfony/http-client Version ^5|^6 | — | — |
open-telemetry/context Version ^1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.