Typed WordPress meta declared with attributes: register_meta(), typed reads and writes, rules, schemas for UI drivers. Runs with or without Laravel.
68%
Total Score
caution
A well-documented first release, but maintenance is unproven and workflow actions are all unpinned.
This is the first release, published today, so there is no historical cadence or evidence of sustained maintenance yet.
There were no commits and no active maintainers in the measured three-month window, but the package is only one day old, so this is limited evidence rather than abandonment.
Composer build tooling is present, but no security-scanning tool was detected; this is a modest transparency gap for a new package.
Version v0.1.0 is an initial non-stable-major release, which indicates an immature API and likely compatibility changes ahead.
Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all six referenced actions are unpinned, which weakens build reproducibility and update integrity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0 | — | — |
pollora/hook Version ^2.0.1 | — | — |
nesbot/carbon Version ^3.0 | — | — |
psr/container Version ^2.0 | — | — |
pollora/discovery Version ^0.1 || ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.