The repository has no commits in the last three months, and all 16 workflow actions are unpinned. Strong documentation, a recent release with notes, organization backing, tests in the repository, and security scanning reduce the concern.
68%
Total Score
75
100
94
67
Post-install and post-update Composer scripts run during dependency operations, creating some operational surface that consumers should understand before adoption.
There were zero commits and zero active maintainers in the last three months, a meaningful sign that maintenance may have slowed.
The repository has zero stars and only one fork and watcher, offering little external adoption evidence; this is supporting evidence rather than a verdict.
The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.
All three workflows were analyzed successfully with no reported audit findings or unsafe triggers, but all 16 action references are unpinned, weakening reproducibility and update control.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
ray/di Version ^2.18 | — | — |
symfony/polyfill-php83 Version ^1.28 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.