The README and release notes make the package understandable, and the linked organization-backed repository is still unarchived. Its small footprint, absent security scanning, and missing license leave limited evidence that it can be maintained safely.
42%
Total Score
75
100
60
50
The latest release was published about five years ago, with no releases in the last 12 months; this is strong evidence of abandonment risk despite the eight historical releases.
No declared license or license file was found in the package or repository, creating a real legal and transparency concern for adoption.
The repository recorded zero commits and zero active maintainers over the last three months, reinforcing the long release gap and leaving little evidence of ongoing maintenance.
Composer is used for the build, which fits the package ecosystem, but no security scanning tools were detected, reducing evidence of proactive dependency and code-risk management.
The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities; this adds a maintenance-process gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
yiisoft/yii2 Version ~2.0.14 | — | — |
yiisoft/yii2-bootstrap Version ~2.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.