The project has only existed for two days, despite 49 releases, and most commits come from one contributor. Documentation, tests, licensing, and active commits are reassuring; workflow permissions and unpinned actions need attention.
68%
Total Score
67
79
83
The repository is owned by an individual account rather than an organization, so the concentrated contributor activity is not offset by visible organizational handoff capacity.
The package is only 2 days old but already has 49 releases, with a median interval of 0 days. This shows active publishing, but provides little evidence of long-term stability.
One contributor made about 80% of the 479 recent commits, while two others contributed the remainder. The active secondary contributors help, but maintenance remains concentrated.
Composer build tooling is used, but no security scanning tools were detected. The extensive tests and active development provide some compensation, but supply-chain checks are less visible.
The assessed version is not a stable major release, indicating an early-stage API and compatibility profile. It is not marked as a prerelease, which partly offsets the concern.
We didn't find any vulnerabilities for this package.
No maintainer information available.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.