shamarkellman/flex-cart
The package includes a substantial README, changelog, tests in the repository, and a matching source project. Its workflows use broad permissions, leave all nine actions unpinned, and contain a high-confidence bot-condition finding.
58%
Total Score
50
92
Health Score Breakdown
All nine analyzed action references are unpinned, two workflows grant top-level write access, and a high-confidence bot-condition finding affects the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, which limits the severity.
Only two releases have been published, both within about one day in March 2026. This shows initial delivery but provides little evidence of an established maintenance cadence.
The repository recorded zero commits and zero active maintainers in the last three months. For a package this new, that is a meaningful but not conclusive abandonment risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Shamar Kellman |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 moneyphp/money Version ^4.0 | — | — |
illuminate/support Version ^11.0||^12.0 | — | — |
illuminate/database Version ^11.0||^12.0 | — | — |
illuminate/contracts Version ^11.0||^12.0 | — | — |
illuminate/collections Version ^11.0||^12.0 | — | — |
Weekly Downloads
Info
- Last Published
- 6 months ago
- Created
- 6 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.