The package includes a README, tests, documentation, and only one runtime dependency. Its MIT license file conflicts with the proprietary manifest declaration, while the source repository could not be found and the project identifies itself as a legacy fork.
54%
Total Score
100
75
100
The artifact contains an MIT license file, but the manifest declares the package proprietary. The mismatch creates avoidable licensing uncertainty despite the recognized license text.
The package has low artifact overlap with open-telemetry/api, does not borrow its identity, and describes itself as a fork. That is transparent but still leaves less evidence of independent release and maintainer capacity than the lookalike package.
The package has 11 releases since August 2021, but none in the last two years; the latest release was in January 2024. This indicates materially reduced maintenance activity.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.