real-digital/avro-serde-php
The README, MIT licensing, tests, and organization-backed repository give consumers useful baseline transparency. The old release and commit history, plus an unsafe checkout credential and unpinned actions, make this a poor long-term dependency.
32%
Total Score
50
75
50
Health Score Breakdown
The package has had no releases in the last 12 months, and its last release was more than five years ago. This is strong evidence of abandonment for a library dependency.
The repository had zero commits and zero active maintainers in the last three months, consistent with the release history showing long-term inactivity.
All 13 action references are unpinned, and the audit found a high-confidence artipacked issue because checkout credentials are not disabled before artifact handling. These weaken release-workflow integrity.
The project uses Make and Composer, showing basic build tooling, but no security scanning tools are present. The tooling baseline is adequate but not strong.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Konstantin Jäckel |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 beberlei/assert Version ^2.9.9|~3.0 | — | — |
flix-tech/avro-php Version ^4.1.0 | — | — |
guzzlehttp/promises Version ^1.4.0 | — | — |
widmogrod/php-functional Version ^6.0 | — | — |
flix-tech/confluent-schema-registry-api Version ^7.3.1 | — | — |
Weekly Downloads
Info
- Last Published
- 5 years ago
- Created
- 8 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.