Documentation, licensing, release notes, and repository tooling are solid. Recent commit activity is absent despite a current release, and all four workflow actions are unpinned, leaving moderate maintenance and build-integrity concerns.
72%
Total Score
75
50
100
67
The package declares 22 runtime dependencies, including many Spiral framework components and testing-related packages; this is a broad dependency surface for a testing SDK and can increase upgrade coupling.
No commits and no active maintainers were recorded in the last 3 months. The current release and recent merged pull requests partly offset this, but the observed commit gap still warrants caution.
No repository security policy was found, leaving vulnerability-reporting expectations less transparent for consumers.
All four workflows were analyzed without high-confidence findings or untrusted-code sinks, but all four action references are unpinned and one workflow grants top-level write permissions. The permissions issue is limited because no dangerous trigger or sink was observed.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nyholm/psr7 Version ^1.8.2 | — | — |
spiral/auth Version ^3.16 | — | — |
spiral/boot Version ^3.16 | — | — |
spiral/core Version ^3.16 | — | — |
spiral/http Version ^3.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.