Arbor Validator has solid initial packaging hygiene: it is MIT-licensed, includes a substantial README, source examples, and tests, has no install-time lifecycle scripts, uses only PHP and required native extensions at runtime, and is backed by a matching, recently pushed repository. However, this is a brand-new v0.1.0 release with only one release and no observed commit activity over the measured three-month window, so maintenance maturity and long-term stability are unproven. The absence of repository security scanning and a security policy adds transparency risk, while zero popularity and no issue activity are weak supporting evidence rather than decisive negatives. It is reasonable for evaluation or controlled adoption, but should not yet be treated as a mature dependency without monitoring future releases and activity.
64%
Total Score
50
100
78
88
The repository is owned by an individual account rather than an organization, so institutional backing is not evident; the matching repository and package mention provide some compensating ownership evidence.
Only one release exists and the package is effectively 0 days old, so there is no demonstrated release cadence or maintenance history yet.
No commits or active maintainers were observed in the measured three-month window; because the project is brand new, this is partly explained by its age but still leaves maintenance capacity unproven.
There are no issues or pull requests and no recent issue activity, so external maintenance and responsiveness cannot yet be demonstrated; the package's very young age limits how strongly this should be weighted.
The repository has no stars, forks, or watchers, providing no community-adoption evidence; for a package released only recently, this is weak evidence rather than a severe concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.