It includes a clear MIT license, tests, a substantial README, and a matching source repository. Its single release, one-person ownership, and roughly twelve years without commits leave little evidence of ongoing maintenance.
38%
Total Score
33
100
81
88
The package has only one release, published roughly twelve years ago, with no releases in the last twelve months. That leaves no evidence of current release maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with roughly twelve years since its last push and indicating a serious maintenance concern.
Only one registry publishing account is listed, and the project is user-owned rather than organization-backed. That creates limited visible publishing redundancy.
The registry namespace and repository are both owned by the same individual, confirming a consistent project identity but providing no organization-level backing.
The repository reports no build tooling and no security scanning tooling. For an old, small JavaScript package this is not decisive alone, but it provides little evidence of maintained engineering hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
robloach/component-installer Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.