The repository has had no commits in five months, and every workflow dependency is unpinned with broad write access. A clear license, repository tests, security policy, and matching source repository provide useful transparency, but the project is still very early.
58%
Total Score
50
50
71
100
There were zero commits and zero active maintainers during the last three months, indicating a significant recent maintenance pause despite the repository remaining available.
Eight runtime dependencies, including native PHP extensions and a separate core package, create meaningful environment and supply-chain coordination requirements for adopters.
The package is only 167 days old and has just two releases, both published within about nine hours, so its maintenance track record is still limited.
The project uses Composer and Make, but no security scanning tools were detected, leaving an avoidable gap in ongoing project hygiene.
The repository is not archived, and it was last pushed about five months ago, but that age makes the lack of recent activity more concerning for a young project.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/container Version ^2.0 | — | — |
psr/simple-cache Version ^3.0 | — | — |
vlucas/phpdotenv Version ^5.6 | — | — |
quillphp/quill-core Version ^0.0.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.