The MIT license, focused six-file package, and lack of install-time scripts reduce adoption and supply-chain friction. Organization ownership provides some handoff capacity, but longer-term maintenance and security practices remain unproven.
55%
Total Score
67
80
83
The package was published today and has only one release, so there is no track record for judging maintenance consistency or release reliability.
One contributor accounts for all observed commits. Organization ownership offers some ability to hand off maintenance, but no second active contributor is evidenced.
Only one commit was observed in the last three months, matching the package's very recent creation but leaving ongoing maintenance capacity unproven.
The repository has no security policy, leaving reporting and response expectations undocumented for a package that handles shipping credentials and tracking integrations.
The assessed version is a prerelease, and all recent releases are prereleases; that is appropriate for early development but adds compatibility risk for consumers.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
shopper/core Version self.version | — | — |
illuminate/http Version ^12.68|^13.27 | — | — |
shopper/shipping Version self.version | — | — |
illuminate/support Version ^12.68|^13.27 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.