This is a generally healthy and usable release: it has a long history since 2015, 137 releases, a recent stable release, no registry deprecation, an unarchived organization-backed repository, explicit MIT licensing, substantial source and test coverage, and no install-time lifecycle scripts or dangerous workflow patterns. The main concerns are that repository commit activity was absent over the last 3 months, popularity is modest, no security scanning or security policy is present, and the single workflow does not declare top-level token permissions. These issues reduce transparency and maintenance confidence but do not outweigh the strong release history, current publication, and repository structure.
78%
Total Score
63
50
89
80
The package declares 9 runtime dependencies and 1 development dependency, including several related Packaged components and database integrations. This is a meaningful dependency surface to maintain, but it is not excessive for the stated data-access functionality.
Only one registry account has publish access, which is a limited publishing base. However, the linked repository is owned by the packaged organization, so the registry count alone is not strong evidence of a single-person project.
The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although the package released recently, the absence of recent commit activity weakens confidence in ongoing maintenance.
There are 3 open issues and 2 open pull requests, with one pull request merged in the last month but no newly opened or closed issues. This shows some recent repository interaction, though issue resolution activity is limited.
The repository has only 4 stars, 2 forks, and 3 watchers, indicating limited external adoption or review. Popularity is supporting evidence rather than a verdict, so this is a modest concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
packaged/log Version ~1.0 | — | — |
packaged/config Version ~1.1 | — | — |
packaged/helpers Version ~1.23||~2.5 | — | — |
packaged/docblock Version ~0.1||~1.0 | — | — |
doctrine/inflector Version ^1.4 || ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.