This is a promising, actively maintained release with a coherent package artifact: it has an MIT license, README, changelog, complete-looking source and test files, no install-time lifecycle scripts, and a repository owned by an organization that matches the package. The package is young at 40 days, but 14 releases and a median release interval of about 6 days indicate active development, and the repository is not archived and was pushed recently. The main adoption risks are that all 12 commits in the last 3 months came from one contributor, the repository has no security scanning or security policy, and the project has no established popularity or issue activity; these are meaningful maturity and continuity concerns but not evidence that the package is unfit to depend on.
78%
Total Score
75
100
83
90
The package is only 40 days old, which limits maturity evidence, but 14 releases and a median interval of about 6 days show active delivery rather than abandonment.
One contributor made all 12 commits in the last 3 months, creating a material continuity and bus-factor risk. Organization ownership provides some capacity for handoff, but no second active contributor is shown.
There are no open issues or pull requests and no issue or pull-request activity in the last month; this is not inherently unhealthy, but it provides little evidence of broader maintenance engagement.
The repository has zero stars, forks, and watchers. Given the package's 40-day age, this is weak supporting evidence rather than a severe concern, but it provides no external adoption signal.
Composer build tooling is present, but no security scanning tools are configured. The build setup is adequate while security-process transparency remains limited.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0 | — | — |
nyholm/psr7 Version ^1.8 | — | — |
psr/http-client Version ^1.0 | — | — |
psr/http-message Version ^2.0 | — | — |
quioteframework/storage Version ^4.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.