All three releases arrived within one day, and this remains an early 0.0.x package with no runtime dependencies. The substantial README, release notes, matching repository, security scanning, and inactive install scripts provide useful transparency and low installation complexity.
62%
Total Score
50
100
81
88
The manifest declares MIT, but the artifact license file is detected as GPL-3.0; although a license is present in both the artifact and repository, the mismatch needs clarification before adoption.
The package has only three releases, all published within about 2 hours, and no later release over its 178-day lifetime; this gives limited evidence of sustained release maintenance.
The repository recorded zero commits and zero active maintainers during the last three months, which is a meaningful sign of slowed maintenance for an early-stage package.
No repository security policy is present. This is a modest transparency gap, though the package is documentation-driven and has GitGuardian scanning enabled.
Version v0.0.3 is an early 0.0.x release rather than a stable major version, so its interfaces and content may still change substantially.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
composer/installers Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.