This is a generally usable and established package: it has been released for about 6 years, has 21 releases including 4 in the last 12 months, uses a stable 1.2.0 release, is not deprecated, has a matching repository, and has clear MIT licensing. However, the repository shows no commits or active maintainers in the last 3 months, while the package has no tests, changelog, security policy, or security scanning; its very low popularity also provides little external validation. The recent release and organizational backing partly offset the maintenance concern, but ongoing maintenance and transparency should be verified before making it a critical dependency.
68%
Total Score
67
100
83
90
A substantial README is present and GitHub Releases are used, but neither the artifact nor repository contains tests or a changelog. For a plugin, the missing tests reduce maintainability and verification transparency.
There were 0 commits and 0 active maintainers in the last 3 months. This conflicts somewhat with the recent registry release and raises a real concern about current development activity.
There are no open issues or pull requests and no recent issue or pull-request activity. This is neutral for a small package, but it also provides no evidence of active community maintenance.
The repository has only 1 star, 0 forks, and 1 watcher. Popularity is not decisive, but this provides little independent evidence of broad review or community adoption.
Composer is used as a build tool, which is appropriate for this PHP package, but no security scanning tools are configured. The missing scanning is a transparency and maintenance gap rather than evidence of maliciousness.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
getkirby/cms Version ^4.0|^5.0 | — | — |
getkirby/composer-installer Version ^1.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.