rozbo/puck
Tests, documentation, stable versioning, and no install scripts make the package easier to evaluate. Its Apache-2.0 declaration conflicts with the repository's WTFPL license, while maintenance appears to have stopped for about nine years. No security policy or scanning further limits transparency.
35%
Total Score
0
60
50
Health Score Breakdown
The package has had no release in about nine years: its latest release was in April 2017 despite seven total releases. This strongly raises abandonment risk.
The repository recorded zero commits and zero active maintainers over the last three months, consistent with the long release gap and showing no current maintenance capacity.
The manifest declares Apache-2.0, but the repository license file was detected as WTFPL. This mismatch creates material legal uncertainty for adopters.
The repository is not archived, which is a compensating sign, but its last push was in August 2017 and does not outweigh the prolonged lack of releases or commits.
The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. The long inactivity makes this gap more significant.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 rozbo |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 twig/twig Version ~1.0 | — | — |
filp/whoops Version ~2.1.6 | — | — |
overtrue/pinyin Version ~3.0 | — | — |
vlucas/phpdotenv Version ^2.4 | — | — |
imangazaliev/didom Version ^1.9.1 | — | — |
Weekly Downloads
Info
- Last Published
- 9 years ago
- Created
- 9 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.