39%
Total Score
unhealthy
Risky: no release since 2017, no license, and the linked repository does not identify this package.
The package has made only four releases, with the latest in October 2017 and none in the last 12 months—about 9 years of registry silence. This is strong abandonment evidence despite the stable version.
The repository had no commits or active maintainers in the last three months, and its last push was in September 2021—about 5 years ago. This reinforces the abandonment concern from the release history.
No registry license declaration or license file was detected in the package or repository. This creates a real adoption and legal-transparency concern.
The repository name does not match the package name, and its README does not mention the package. That makes package-to-source ownership less transparent and weakens confidence that the repository is the intended home.
The repository has 1 star, 0 forks, and 1 watcher, indicating very little visible adoption or community support. Popularity is supporting evidence rather than decisive on its own, but it provides no compensating maintenance signal.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
atrox/matcher Version ^1.0 | — | — |
guzzlehttp/guzzle Version ^6.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.