It includes a clear MIT license, repository tests, and release notes for this version. The source is not archived, matches the package, and has organization backing, though its small audience limits external validation.
72%
Total Score
100
75
100
The package is only 96 days old, with six releases concentrated in its first 19 days and no newer release shown after July 4. This demonstrates early activity but leaves limited evidence of long-term maintenance.
The repository has 7 stars, no forks, and no watchers, so there is little community usage evidence. Popularity is supporting evidence only and does not outweigh the project’s direct maintenance signals.
Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.
Version v0.1.6 is not a stable major release, so its API and behavior may still change. It is not marked as a prerelease, which partly offsets that concern.
The single workflow was fully analyzed, uses job-level permissions, and has no audited findings or untrusted checkout paths. All three action references are unpinned, leaving avoidable dependency-drift risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
twig/twig Version ^3.0 | — | — |
fakerphp/faker Version ^1.23 | — | — |
symfony/config Version ^6.4||^7.0||^8.0 | — | — |
symfony/console Version ^6.4||^7.0||^8.0 | — | — |
symfony/http-kernel Version ^6.4||^7.0||^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.