renoki-co/thunder
The package has a clear license, useful documentation, repository tests, and matching organization backing. CI has four unpinned actions and a low-confidence cache warning, while no security policy is published; these add modest ongoing-maintenance concerns.
54%
Total Score
75
86
50
Health Score Breakdown
Only two releases were published, with the latest on November 9, 2021 and none in the last 12 months. That leaves this release nearly five years old and raises meaningful compatibility and abandonment concerns.
The repository shows zero commits and zero active maintainers in the last three months, although its last push was February 2, 2026. The recent push partly offsets the inactivity reading but does not establish a reliable release cadence.
The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear. Dependabot is enabled, which provides some compensating security maintenance tooling.
All four analyzed action references are unpinned, and the audit reported a low-confidence cache-poisoning pattern. The workflow has no untrusted checkout or script-injection findings, so this is build hygiene rather than a severe risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Alex Renoki |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/cashier Version ^13.5.6 | — | — |
stripe/stripe-php Version ^7.100 | — | — |
Weekly Downloads
Info
- Last Published
- 4 years ago
- Created
- 4 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.