It has clear licensing, release notes, a matching source tree, and organization backing. Workflow credential inheritance and unpinned actions weaken build hygiene.
62%
Total Score
75
100
88
75
The package has existed since 2018 with 11 releases, but it has had no release in the last two years. That is a meaningful maintenance concern for a dependency, despite its established history.
The repository recorded zero commits and zero active maintainers in the last three months. Combined with no recent registry releases, this indicates stalled recent development.
There are no open issues and one open pull request, but no issues or pull requests were merged in the last month. This provides little evidence of current maintenance.
The repository is not archived, although its last recorded push was in August 2024. The active archive status is positive, while the older push date aligns with the maintenance concern.
The repository has no published security policy. This is a transparency gap, though it is less serious for a theme than for a security-sensitive library or service.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
composer/installers Version ^2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.