Usable with caveats: this is a mature, actively released package with tests, documentation, and a matching source repository. However, no commits or active maintainers were recorded in the last three months, and the repository lacks a security policy.
72%
Total Score
50
100
94
70
The package uses a post-autoload-dump install lifecycle script. This is a point to review during installation, but the provided signal does not show dangerous behavior or make it a severe dependency risk.
Only one registry account has publish access, which creates some continuity risk, although the repository is user-owned and the package has a long release history with recent releases.
The registry namespace and repository owner match, but the project is backed by an individual rather than an organization; this is consistent with the single-maintainer structure and limits visible redundancy.
There were zero commits and zero active maintainers during the last three months, despite the recent registry release; this is the clearest maintenance concern and may indicate a pause after that release.
The repository has 7 open issues and 1 open pull request, but no issues or pull requests were opened or closed during the last month; this suggests limited recent interaction rather than strong ongoing support.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/guzzle Version ^7.2 | — | — |
illuminate/config Version ^10.0 | ^11.0 | ^12.0 | ^13.0 | — | — |
illuminate/routing Version ^10.0 | ^11.0 | ^12.0 | ^13.0 | — | — |
illuminate/support Version ^10.0 | ^11.0 | ^12.0 | ^13.0 | — | — |
spatie/laravel-data Version ^2.0 | ^3.0 | ^4.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.