The release has a usable README, exact-version release notes, and a matching organization-owned repository. License text differs from the declared license, and the project has no security policy; support also depends on one recent contributor.
62%
Total Score
67
79
83
The artifact declares LGPL-3.0-only and includes a license file, but the detected file text is GPL-3.0. That mismatch should be clarified before use because it may change redistribution obligations.
Only two releases were published, both in March 2018, with no registry releases in the last 12 months. The recent repository push provides some compensating evidence but does not show a sustained release cadence.
All recent commits came from one contributor. Organization ownership offers some handoff capacity, but no second active contributor is shown to support it.
There was one commit in the last three months from one active maintainer. This shows some current attention, but not enough activity to establish durable maintenance.
Composer is used for builds, but no security-scanning tooling is present. For this small package, the missing scanning is a modest transparency gap rather than a severe risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
khill/php-duration Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.