The API is well documented, tested, licensed, and avoids install-time scripts. Pin v0.3.0 and reassess before upgrading as the project develops.
70%
Total Score
63
100
78
75
Only one registry maintainer is listed. Because the repository is user-owned rather than organization-backed, this leaves limited publishing redundancy.
The package is self-described as a fork-like project, but artifact overlap is 0 and it does not borrow the lookalike's identity; this is a naming concern rather than evidence of a copy.
The registry and repository are owned by the same individual, confirming source alignment but providing no organization-level maintenance backing.
The package is only 23 days old, with three releases and a median interval of about 11.5 days; this shows early activity but not mature release history.
All recent commits came from one contributor, so maintenance depends entirely on that person and has no demonstrated handoff capacity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-client Version ^1.0 | — | — |
psr/http-factory Version ^1.0 | — | — |
psr/http-message Version ^1.1 || ^2.0 | — | — |
php-http/discovery Version ^1.20 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.