Unfit to use: the package is explicitly abandoned and has had no release since February 2023. The repository remains available and has good basic packaging, but the replacement package and long-term inactivity make this release a poor dependency choice.
18%
Total Score
50
67
63
Packagist marks the entire package as abandoned and identifies vsrklabs/laravel-mongo-activitylog as its replacement. This is a severe adoption risk because future fixes and compatibility work should be expected elsewhere.
This is the only release, published over three years ago, with no releases in the last 12 months. That strongly indicates the package is not being maintained for current consumers.
One of six workflows uses pull_request_target for automated Dependabot merging. No untrusted checkouts or script-injection patterns were detected, but this privileged workflow warrants some caution.
The repository owner is an individual account rather than an organization, and no organizational backing is shown. This does not prove abandonment, but it provides limited continuity assurance alongside the package's abandoned status.
The repository has zero stars, forks, and watchers. Popularity is not decisive by itself, but this provides no supporting evidence of community adoption or review.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/config Version ^8.0 || ^9.0 || ^10.0 | — | — |
illuminate/support Version ^8.0 || ^9.0 || ^10.0 | — | — |
illuminate/database Version ^8.69 || ^9.27 || ^10.0 | — | — |
spatie/laravel-package-tools Version ^1.6.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.