This release appears reasonably healthy to depend on: it is actively released, currently stable, not deprecated or archived, has a clear BSD-3-Clause license, substantial documentation, changelog and repository test coverage, and recent repository activity. The main concerns are that the project is young, all recent commits come from one contributor, the repository has no declared security policy or security-scanning tools, and the runtime dependency set is moderately broad. These are meaningful maintenance and transparency risks, but the active release cadence, build tooling, read-only workflow permissions, safe workflow analysis, and matching repository provide substantial compensating evidence.
78%
Total Score
70
50
89
90
Nine runtime dependencies, including database, migration, console, and related Yii packages, create moderate dependency-surface and compatibility obligations. The profile is coherent with the package's database-backed Yii functionality but is not minimal.
Only one registry account has publish access, creating release continuity risk. This is partly consistent with the repository also being user-owned, but no organizational backing is shown.
The source repository is owned by a user rather than an organization, so there is no demonstrated organizational succession or maintenance backing.
The package is only 82 days old, which limits demonstrated longevity, but it has 11 releases in that period with a median interval of about 6 days, indicating active maintenance.
One contributor made all 28 commits in the last three months, so the project has a significant single-person continuity risk. The active commit volume compensates for abandonment concerns but not for the lack of maintainer redundancy.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0 | — | — |
psr/clock Version ^1.0 | — | — |
yiisoft/db Version ^2.0 | — | — |
symfony/console Version ^6.4 || ^7.0 | — | — |
psr/simple-cache Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.