The release is documented, tested, licensed, and backed by an organization with security tooling. Its small audience, no commits in the last three months, and weak workflow pinning leave maintenance and build-reproducibility concerns.
62%
Total Score
75
100
94
75
There were 0 commits and 0 active maintainers in the last 3 months, which is a meaningful maintenance warning, partly offset by the release pushed on December 17, 2025.
The repository has 2 stars, 0 forks, and 1 watcher. This indicates a very small user and contributor base, increasing reliance on the current maintainers, but popularity alone is not a health verdict.
Both workflows were analyzed without file failures and have no untrusted checkouts or script injection, but all 13 action references are unpinned and two archived actions were found. The low-confidence cache-poisoning result is hygiene evidence rather than a severe risk on its own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-client Version ^1.0.1 | — | — |
psr/http-factory Version ^1.0.1 | — | — |
php-http/discovery Version ^1.14.1 | — | — |
symfony/http-client Version ^7.3 | — | — |
php-http/client-common Version ^2.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.