Base PHP worker for the RoadRunner application server: receives payloads over Goridge, sends responses and manages the worker pool
72%
Total Score
caution
A first release with no history and fully unpinned CI actions keeps this otherwise well-backed package in the caution range.
This is the package's first recorded release, published on October 10, 2026, so there is no established release history or cadence yet.
The repository records zero commits and zero active maintainers in the last three months, which is a maintenance warning, although the release and recent pull-request merges provide some compensating evidence.
All six workflows were analyzed without high- or medium-severity findings, and no untrusted checkout or script-injection paths were found. However, all 10 action references are unpinned and one workflow grants top-level write permissions, creating a workflow-hygiene caution.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2.0 || ^3.0 | — | — |
spiral/roadrunner Version ^3.0 | — | — |
roadrunner/goridge Version ^4.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.