It includes tests, a matching Apache-2.0 license, and no install-time scripts. The repository remains unarchived, but its unpinned container image adds build-reproducibility risk.
38%
Total Score
0
83
67
This is the package's only release, published about 1 year 9 months ago, with no releases in the last 12 months. That limited history provides little evidence of ongoing maintenance.
The repository recorded no commits and no active maintainers in the last 3 months, consistent with the package's warning that active maintenance is not guaranteed.
The repository has no security policy, leaving no documented channel or process for reporting security issues. This is a transparency gap, though it does not by itself show abandonment.
Both workflows were analyzed completely, but all 5 action references are unpinned and the audit found a high-confidence unpinned container image. This weakens build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
swoft-fork/framework Version ~2.1.0 | — | — |
swoft-fork/connection-pool Version ~2.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.