The small codebase has tests, release notes, and no install-time scripts. Organization backing helps, but long release gaps and one active contributor limit confidence in sustained maintenance.
65%
Total Score
67
75
100
The artifact includes a license file, but it identifies LGPL-3.0 while the manifest declares MIT; this mismatch creates avoidable licensing uncertainty.
The package has only 3 releases across roughly 10 years, with a median interval of about 4.9 years; the release in the last 12 months is positive but does not establish a regular cadence.
All 3-month commit activity comes from one contributor, concentrating short-term maintenance responsibility; organization ownership provides some handoff capacity but does not remove the concentration.
The repository recorded 2 commits in the last 3 months, showing recent activity, but the volume is low for establishing sustained maintenance on its own.
Version 0.1.2 is not a stable major release, so compatibility expectations are weaker even though it is not marked as a prerelease.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.