spatie/sidecar-shiki

Name lookalikedanger

The package is flagged as borrowing the identity of spatie/invade, a package with far more downloads, and is not described as a fork. This creates a serious risk that consumers wanted the established package instead.

Release historycaution

The latest registry release was over two years ago, with no releases in the last 12 months. Its earlier seven releases show an established history but do not offset the current release gap.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Combined with the long release gap, this raises concern about current maintenance capacity.

Security policycaution

The repository has no security policy. This is a transparency gap for a package integrated into applications, though it is not severe enough to determine the score alone.

Workflow auditcaution

All workflows were analyzed, but all 11 action references are unpinned and a high-confidence finding reports an unpinned container image. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this remains a hygiene concern rather than a severe workflow risk.