Documentation, tests, release notes, and a matching source repository make the package transparent to adopt. Maintenance has stalled for nearly two years, while workflow pinning and a high-confidence template-injection finding add operational risk.
62%
Total Score
50
100
81
75
There is one registry publishing maintainer. The repository is user-owned rather than organization-backed, so the narrow maintainer base provides limited continuity.
The registry namespace and repository owner match, but the owner is an individual account rather than an organization, providing limited visible project backing.
The package has 18 releases and a historically regular median interval, but it has had no release in the last 12 months and its latest release was nearly two years before collection.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release gap and raising abandonment risk.
There are five open issues but no issues or pull requests were opened or closed in the last month, offering no evidence of current issue handling.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
composer/composer Version ^2.5.8 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.