The project includes tests, a substantial README, and a matching source repository. Its mixed RPL/proprietary licensing and lack of a security policy add adoption friction.
35%
Total Score
0
57
75
This package has made only one release, on March 13, 2020, with none in the last six years. That is strong evidence of abandonment for a library tracking a private API.
There were zero commits and zero active maintainers in the last three months. Combined with the one-release history, this indicates a project with no current maintenance capacity.
The release includes license files, so it is not unlicensed, but the manifest combines RPL-1.5 with a proprietary designation. That creates meaningful uncertainty for downstream commercial or redistributable use.
Composer build tooling is present, but no security-scanning tools were detected. This is a transparency and maintenance gap, though not as serious as the lack of recent development.
The repository is not archived, which is a modest positive, but its last push was on March 13, 2020 and does not offset the long period without activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0 | — | — |
winbox/args Version 1.0.0 | — | — |
react/socket Version ^0.8 | — | — |
react/promise Version ^2.5 | — | — |
symfony/process Version ^3.4|^4.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.