It includes clear documentation, tests, a changelog, and matching source, with a stable MIT release. Limited recent activity, no security policy, and weak workflow pinning leave maintenance and build-integrity concerns.
58%
Total Score
50
100
83
63
A post-autoload-dump lifecycle script runs during installation, adding execution during dependency setup and warranting modest caution.
One registry publishing account is listed, and the linked repository is user-owned rather than organization-backed, leaving a thin apparent publishing base.
The registry namespace and repository owner align, but both are user-owned, so there is no organizational backing to offset the thin maintainer base.
The package has made no releases in the last 12 months, and its latest release was on February 19, 2025, indicating a substantial maintenance pause despite eight total releases.
There were zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance has stalled.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
google/apiclient Version ^2.17.0 | — | — |
illuminate/contracts Version ^10||^11 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.