Its documentation, tests, and release notes make integration straightforward, with clear organizational ownership. Maintenance is currently quiet, and all 14 workflow actions are unpinned, leaving meaningful upkeep and build-reproducibility concerns.
68%
Total Score
75
100
94
75
The package has existed since December 2021 with nine releases, but only one release in the last 12 months and a median interval of about 192 days indicate a slow cadence.
The repository recorded zero commits and zero active maintainers in the last three months, despite a recent push and current release, indicating limited ongoing development activity.
No repository security policy was found. This is a transparency gap, though it is less significant for a small static-analysis plugin than for a security-sensitive service.
All four workflows were analyzed successfully with no reported audit findings or untrusted-code sinks. However, all 14 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
vimeo/psalm Version ^6.13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.