The package is clearly licensed and documented, with a small runtime dependency set and no install-time scripts. Its very small user and contributor base, no recent commits, and repository identity mismatch leave meaningful maintenance and provenance concerns.
52%
Total Score
38
100
61
83
There were zero commits and zero active maintainers in the last three months, a strong sign that maintenance has paused for this release line.
The repository name does not match the package name and its README does not mention the package, so the repository may not clearly belong to this release. That weakens source provenance even though name differences can occur for subpackages.
One registry maintainer provides little publishing redundancy, increasing continuity risk for a young package. The linked repository is user-owned rather than organization-backed, so there is no provided evidence of broader support.
The registry namespace is orangecat while the repository belongs to the individual user olivertar. The provided ownership data does not show organization backing that would compensate for the thin maintainer base.
The package has only two releases, both published about 112 days ago, with no later release activity. This is limited history and gives little evidence of sustained maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
magento/framework Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.