The package has a clear README, matching repository, and MIT license. Its small dependency surface and lack of install scripts limit operational exposure, but maintenance confidence remains weak.
44%
Total Score
38
72
75
The package has made only three releases, all within a short period ending in November 2024, and none in the last 12 months. This strongly suggests abandonment risk for a storage integration.
There were zero commits and zero active maintainers in the last three months, consistent with a project that has not been maintained since November 2024. This is a substantial abandonment concern.
One registry maintainer is consistent with the user-owned repository, but it creates a thin bus factor with no observed activity to show continuing support.
A 1,506-character README documents installation, configuration, and OCI-specific behavior, which supports consumers. The absence of tests and a changelog is not a packaging defect for this artifact, but it leaves less evidence of compatibility and change tracking.
The package and repository are owned by the same individual account, with no organization backing shown. That makes the single-maintainer activity gap more consequential.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
league/flysystem Version ^3.12 | — | — |
illuminate/support Version ^v11.9.2 | — | — |
hitrov/oci-api-php-request-sign Version dev-main | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.