The stable package includes a README, license, and release notes, with no install-time scripts. Its tiny contributor footprint and absent security policy leave long-term support uncertain; pin v1.2.0 if its older Amazon MWS integration is required.
60%
Total Score
67
83
75
The latest registry release was in January 2019, about seven years ago, and there were no releases in the last 12 months. This materially raises maintenance and abandonment concerns.
All recent commits came from one contributor. Organization backing provides some handoff potential, but no second active contributor is shown in this signal.
There was one commit in the last three months from one active maintainer, showing some current activity but very limited maintenance capacity.
Composer is used for builds, but no security-scanning tooling was detected. The missing scanning is a modest transparency and maintenance gap rather than a standalone severe risk.
The repository has no security policy, leaving disclosure and response expectations undocumented. This is a transparency gap for a package that handles configuration data.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.