The license declaration conflicts with the detected GPL-3.0 file, and all 14 workflow actions are unpinned. Good tests, documentation, read-only workflow permissions, and an unarchived repository provide useful support despite nearly five years without a registry release.
58%
Total Score
50
100
71
75
The manifest declares MIT, while the artifact detects GPL-3.0 and includes a license file; the repository also has a license file, but the declaration mismatch needs resolution before adoption.
The repository is owned by an individual rather than an organization, so the single registry maintainer is consistent with the project backing but indicates limited visible redundancy.
The package has 12 releases but none in the last 12 months, and its latest registry release was nearly five years ago. This is a meaningful maintenance concern.
There were no commits and no active maintainers in the last three months, supporting the broader concern that maintenance has slowed substantially.
There are no open issues or pull requests and no recent issue or pull-request activity; this is neutral for a small stable project but provides little evidence of active maintenance.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.