The package includes tests, a substantial README, release notes, and a matching source repository. Its single maintainer and absent security policy leave limited evidence for ongoing stewardship; workflow references are unpinned.
58%
Total Score
50
100
83
50
The package has 28 releases, but none in the last 12 months and the latest registry release was about 6 years ago. This materially increases abandonment and compatibility risk.
The repository recorded no commits and no active maintainers in the last 3 months. A push in December 2024 shows some later activity, but current maintenance evidence is weak.
The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a maintenance and governance gap, not evidence of malicious behavior.
The single workflow was fully analyzed with no dangerous triggers or audit findings, but both of its two action references are unpinned. That leaves avoidable build-integrity risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
smuuf/php-peg Version ^2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.