It has strong documentation, tests, licensing, and release notes for this version. Composer dependencies are substantial, while repository security practices remain limited.
62%
Total Score
67
50
88
67
The package declares 11 runtime dependencies spanning document engines, image processing, QR codes, and Laravel components. That breadth is understandable for its stated functionality but increases maintenance and transitive dependency surface.
A post-autoload-dump Composer script runs during installation. Such scripts increase installation complexity and deserve review, though this single script is not severe on its own.
The source repository is owned by an individual account, not an organization. This provides no organizational maintenance cushion when considered alongside the single-contributor activity.
The package is only 49 days old with four releases, all published within a short period. This shows activity but provides limited evidence of long-term maintenance.
One contributor made all recent commits, with a 100% share. The repository owner is an individual rather than an organization, so there is no provided backing evidence to offset this concentration.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
mpdf/mpdf Version ^8.3 | — | — |
setasign/fpdf Version ^1.9 | — | — |
illuminate/support Version ^11.0|^12.0 | — | — |
intervention/image Version ^4.2 | — | — |
bacon/bacon-qr-code Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.