The repository includes tests, a changelog, and a security policy, while the package has no install-time scripts. Its two GitHub Actions references are unpinned, and commit activity was absent over the past three months despite 10 merged pull requests.
76%
Total Score
75
100
100
83
No commits or active maintainers were recorded over the past three months, which is a maintenance concern, although 10 pull requests were merged during the past month and a release was published recently.
The workflow audit found no dangerous triggers, untrusted checkouts, script injection, or other audit findings, but both analyzed action references are unpinned, leaving avoidable update and supply-chain uncertainty.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nesbot/carbon Version ^2.20 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.