Clear documentation, tests, release notes, and a simple PHP-only runtime dependency make the package easy to evaluate. MIT licensing and no install scripts reduce adoption friction; pin v1.1.0 because workflow references are unpinned.
60%
Total Score
50
100
92
100
A single registry maintainer limits the visible publishing base and creates some continuity risk. The package is small and the linked repository matches it, which partly offsets that concern.
Only two releases were published, with the latest about 2 years ago and no releases in the last 12 months. The stable version and short initial interval help, but the long silence raises maintenance risk.
The repository recorded no commits and no active maintainers in the last 3 months, consistent with a project that has been inactive since its last release. This is the main abandonment concern.
Both workflows were fully analyzed with no dangerous triggers, sinks, or audit findings, but all 6 action references are unpinned. That is a modest reproducibility and workflow supply-chain hygiene gap.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.