The package is clearly licensed, documented, and backed by repository tests, static analysis, and read-only, pinned workflows. Its short history leaves long-term maintenance capacity unproven.
68%
Total Score
67
88
75
The package is only 40 days old and has one release, so there is not yet enough history to demonstrate sustained maintenance. This is an early-project concern rather than evidence of abandonment.
One contributor made all three recent commits, creating a concentrated maintenance dependency. The linked repository and package do match, but no second active contributor is shown.
The repository recorded three commits in the last three months, but all activity came from one maintainer. For a project this new, that shows activity while leaving continuity unproven.
No repository security policy was found, which reduces the transparency of vulnerability reporting and response expectations. Static analysis and workflow controls provide partial hygiene compensation but do not replace a policy.
Version v0.1.0 is not a stable major release, indicating that the API may still change substantially. It is not marked as a prerelease, which provides some compensation.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/clock Version ^1.0 | — | — |
yiisoft/http Version ^1.2 | — | — |
psr/http-factory Version ^1.0 | — | — |
psr/http-message Version ^2.0 | — | — |
psr/http-server-handler Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.