Healthy and actively developed, but still early-stage and reliant on one contributor. The repository has strong testing, security tooling, and recent activity, while the rapid release cadence and single-person maintenance base warrant monitoring.
78%
Total Score
75
100
88
88
The source repository is owned by the same individual associated with the package namespace, providing direct ownership alignment but no organizational backing.
The package has shipped 30 releases in 46 days, with the latest released very recently, showing strong activity but also a fast-moving, immature release history.
All 63 recent commits came from one contributor, creating a genuine continuity risk if that person becomes unavailable; the linked repository is user-owned rather than organization-owned, so there is no shown organizational handoff capacity to offset it.
Eleven workflows declare read-only permissions and none declare top-level write permissions; three omit top-level permissions, leaving a limited workflow-hardening gap.
Version v0.2.3 is not a stable major release, so the public API may still change despite the absence of prerelease labeling.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
flarum/core Version ^2.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.