The package is small and focused, with a matching repository, README, and no install scripts. Its license text conflicts with the declared GPL-3.0-only, and workflow actions are unpinned.
55%
Total Score
50
100
79
67
A license file is present, but it identifies AGPL-3.0 while the manifest declares GPL-3.0-only. That mismatch should be resolved before relying on the package's licensing terms.
The package has 16 releases, but none in the last year; its latest release was over a year ago, which raises maintenance and abandonment concerns.
The repository recorded no commits and no active maintainers in the last three months, consistent with the absence of recent releases and indicating a thin maintenance picture.
Composer build tooling is present, but no security scanning tooling was detected. This is a modest transparency and maintenance gap for a package with no other security process shown.
The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a minor transparency gap rather than evidence that the package is unsafe.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
drupal/core-recommended Version >=10.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.