It has tests, a changelog, a matching repository, and an MIT license. The workflow uses three unpinned actions, and the repository has no security policy.
55%
Total Score
50
80
50
The package has had no release in nearly four years: its latest release was November 1, 2022, despite four releases overall. This substantially raises abandonment risk.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. Existing tests and release notes show earlier work but do not offset the current inactivity.
The linked repository has no security policy. This weakens vulnerability-reporting transparency, although the repository is small and has an otherwise visible build and test structure.
The only workflow was fully analyzed and found no dangerous sinks or audit findings, but all three action references are unpinned. That leaves routine build-integrity exposure and is a hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.1 || ^2.0 || ^3.0 | — | — |
react/http Version ^1.2 | — | — |
nesbot/carbon Version ^1.2 || ^2.26 | — | — |
php-di/php-di Version ^6.2 | — | — |
vlucas/phpdotenv Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.