The package has a clear README, a stable version, and a matching source repository. Its short release history, six-month release gap, and lack of security tooling leave maintenance and transparency concerns.
62%
Total Score
50
100
83
50
A post-autoload-dump install-time script runs during Composer autoload generation. This is common for packages that configure tooling, but it adds execution during installation and warrants attention.
The repository is owned by an individual user rather than an organization, so the project has limited visible institutional backing.
Only three releases exist, all within the first 10 days, and the latest release was about six months ago despite the package being less than a year old. This suggests uncertain ongoing maintenance.
There are no open issues or pull requests and no recent activity. While this avoids an unresolved backlog, it provides no evidence of an active user or contributor community.
The repository has one star and no forks or watchers, offering little independent evidence of maturity. This is supporting evidence only and does not outweigh the maintenance signals by itself.
We didn't find any vulnerabilities for this package.
No maintainer information available.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.