The package has a useful README, tests, changelog, MIT licensing, and an organization-backed repository. Its workflows use six unpinned actions, and the audit was incomplete for one file, adding a smaller maintenance concern.
56%
Total Score
50
88
50
The package has seven releases, but none in the last 12 months and the latest release was published over three years ago. This is strong evidence of stalled maintenance for a library that may need compatibility fixes.
The repository recorded zero commits and zero active maintainers during the last three months, consistent with the long release gap. No newer activity is provided to offset the abandonment concern.
All six analyzed action references are unpinned, and one workflow file failed auditing, so the workflow review is incomplete. However, there are no reported dangerous triggers, untrusted checkouts, script injections, or audit findings.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/dotenv Version ^6.2 | — | — |
guzzlehttp/guzzle Version ^7.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.