The repository has very little community activity and its workflows need tightening, though organizational backing, testing, security tooling, and a recent release provide useful support. Pin this version while confirming maintenance resumes for future updates.
67%
Total Score
75
94
67
There were no commits and no active maintainers in the last three months, a meaningful maintenance warning, although the repository was pushed recently and the release is current.
The repository has only 4 stars, 4 watchers, and no forks, indicating a small user and contributor footprint; popularity is supporting evidence rather than a verdict.
The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.
All 24 analyzed action references are unpinned, and the audit found two high-confidence secrets-inherit findings; one workflow also has top-level write permissions, creating avoidable CI hygiene and credential-scope concerns.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/guzzle Version ^7.10 | — | — |
simplesamlphp/assert Version ^2.0 | — | — |
symfony/http-foundation Version ^7.4 | — | — |
surfnet/yubikey-api-client Version ^2.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.