tarfin-labs/event-machine
The MIT license, clear README, release notes, and substantial repository activity make the package easy to evaluate and maintain. Pin workflow actions and account for the single active contributor before adopting it in a critical system.
72%
Total Score
83
100
50
Health Score Breakdown
The package runs a post-autoload-dump install-time script. This is a mild supply-chain and installation-behavior concern, though the signal does not show that the script is harmful.
One contributor made 100% of the 510 commits in the last 3 months. Organization backing provides some handoff capacity, but the current contributor concentration remains a real continuity concern.
No repository security policy was found. That is a transparency gap for reporting vulnerabilities, though it does not by itself indicate abandonment or unsafe code.
Both workflows were analyzed with no reported audit findings or untrusted checkout/script-injection sinks. However, all 25 action references are unpinned and one workflow grants top-level write permissions, creating workflow integrity and permission-hygiene concerns.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Yunus Emre Deligöz |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 nikic/php-parser Version ^5.4 | — | — |
spatie/laravel-data Version ^4.13.0 | — | — |
illuminate/contracts Version ^11.0.8|^12.0|^13.0 | — | — |
spatie/laravel-package-tools Version ^1.14.0 | — | — |
Weekly Downloads
Info
- Last Published
- 23 days ago
- Created
- 2 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.