The repository has solid tests, release notes, licensing, and Dependabot support. Workflow references are unpinned and the latest three months show only two commits from one contributor, leaving maintenance capacity thin.
68%
Total Score
67
100
75
One contributor made all two recent commits, concentrating current maintenance in a single person; organization ownership provides some handoff potential but no second active contributor is shown.
Only two commits were recorded in the last three months, which indicates sparse recent development even though the repository remains active.
The repository has no security policy, leaving disclosure and response expectations undocumented for a library that handles Discord integrations.
Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
react/async Version ^4.0.0 | — | — |
exan/eventer Version ^1.0.3 | — | — |
ratchet/pawl Version ^0.4.3 | — | — |
nesbot/carbon Version ^3.0 | — | — |
react/promise Version ^3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.