This release appears healthy and reasonable to depend on: it is actively maintained, has frequent releases, a current non-archived repository, substantial repository tests and changelog coverage, matching package identity, security policy, Dependabot scanning, and no analyzed dangerous workflow patterns. The main reservations are that the package is relatively young, remains below major version 1.0, has only one registry maintainer, uses install/update lifecycle scripts, and has limited repository popularity; these warrant normal review and pinning practices but do not outweigh the strong maintenance and transparency evidence.
86%
Total Score
80
100
89
80
The package defines post-install and post-update Composer scripts, which increase installation-time execution exposure and merit review, although lifecycle scripts are common in framework packages.
Only one account has registry publish access, creating a publishing bus-factor concern; however, registry access reflects publishing permissions rather than actual maintenance activity, which is active in the repository.
The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the narrow registry maintainer base; nevertheless, the observed two-person commit activity is positive.
The repository has only 6 stars, 0 forks, and 1 watcher, indicating limited adoption evidence; popularity is supporting evidence rather than a health verdict, especially given the package's young age.
Five workflows declare read-only permissions, but one workflow lacks top-level permissions and another has top-level write permissions; this is a mild workflow-hygiene concern despite the absence of dangerous workflow patterns.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/queue Version ^11.0||^12.0||^13.0 | — | — |
illuminate/redis Version ^11.0||^12.0||^13.0 | — | — |
illuminate/console Version ^11.0||^12.0||^13.0 | — | — |
illuminate/support Version ^11.0||^12.0||^13.0 | — | — |
illuminate/contracts Version ^11.0||^12.0||^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.