The package includes tests, an MIT license, and organization-backed ownership, but its maintenance record is very old. The missing security policy and modest dependency footprint add transparency and upkeep concerns.
45%
Total Score
75
50
60
50
The latest release was over seven years ago, with no releases in the last 12 months; this is strong evidence of abandonment risk despite 13 historical releases.
The release declares 14 runtime dependencies, creating a relatively broad upkeep surface for a small package. This is a maintenance consideration, though it is secondary to the absence of recent releases.
There are no open issues or pull requests and no activity in the last month; while a clean tracker can be healthy, here it is consistent with the repository's long inactivity.
The repository has zero stars and forks and only one watcher, providing little supporting evidence of external use or review. Popularity is not decisive, but it reinforces the limited maintenance evidence.
The repository is not archived, which preserves a path for maintenance, but it was last pushed over seven years ago and does not offset the stale release history.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
aura/di Version ^3.0 || ^4.0 | — | — |
filp/whoops Version ^2.1 | — | — |
aura/payload Version ~3.0 | — | — |
polus/config Version ^1.0 | — | — |
relay/middleware Version ~1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.