It has a clear MIT license, organization backing, security scanning, and release notes for this version. The workflows leave actions unpinned, and the source repository does not explicitly identify this package by name.
67%
Total Score
75
100
88
67
The project has released 24 versions since February 2021 and published this version recently, but only one release appeared in the last 12 months, indicating a slower cadence.
The repository recorded zero commits and zero active maintainers in the last three months, despite the recent release, leaving current maintenance momentum uncertain.
The repository name does not match the registry package name and the package-name check found no explicit README mention, so package-to-source ownership is less transparent even though the README describes a RoadRunner CLI.
No repository security policy was found, leaving disclosure guidance less transparent for a production-oriented tool.
Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all two action references are unpinned, weakening reproducibility and update safety.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/yaml Version ^5.4.49 || ^6.4.17 || ^7.2 || ^8.0 | — | — |
composer/semver Version ^3.4 | — | — |
symfony/console Version ^5.3 || ^6.0 || ^7.0 || ^8.0 | — | — |
spiral/tokenizer Version ^2.13 || ^3.15 | — | — |
symfony/http-client Version ^4.4.51 || ^5.4.49 || ^6.4.17 || ^7.2 || ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.