Documentation, tests, and release notes make the package easier to adopt. Development is active, but the project is young and all recent commits come from one contributor; workflow action pinning also needs improvement.
68%
Total Score
83
100
83
100
The package is only 96 days old with two releases, so its long-term maintenance record is still limited.
All 26 recent commits came from one contributor, creating a meaningful continuity risk; organization backing provides some handoff capacity but no second active contributor is shown.
The repository has one star and no forks or watchers, providing little external adoption evidence; popularity is supporting evidence rather than a health verdict.
Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and maintenance gap.
The single workflow was fully audited, uses read-only permissions, and has no dangerous sinks or audit findings. Both action references are unpinned, which is a minor supply-chain hygiene gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0 | — | — |
psr/clock Version ^1.0 | — | — |
symfony/yaml Version ^8.0 | — | — |
symfony/clock Version ^8.0 | — | — |
symfony/config Version ^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.