This is a usable, established package with a release history spanning nearly 5 years, 65 releases, 16 releases in the last 12 months, and a current stable release. It is not deprecated or archived, has a clear LGPL-3.0-or-later declaration, a small runtime dependency set, and no install-time lifecycle scripts. However, the linked repository shows no commits or active maintainers in the last 3 months, has no tests, changelog, security policy, or security scanning, and the repository neither matches the package name nor mentions it in its README, creating some transparency and maintenance uncertainty. Overall, it is reasonable to consider, but adoption should include monitoring and verification of ongoing maintenance.
68%
Total Score
50
100
78
90
Only one registry account has publishing access. This is a meaningful continuity concern for a user-owned project, although the long release history shows that the account has been actively publishing.
A substantial README is present, but neither the artifact nor repository contains tests or a changelog. The repository's GitHub Releases provide some release transparency, but the absence of tests remains a maintenance-quality gap.
The repository is owned by an individual user rather than an organization, so the single-publisher and single-owner structure provides limited redundancy if the maintainer becomes unavailable.
The repository recorded zero commits and zero active maintainers during the last 3 months. This conflicts with the strong registry release cadence and is a caution for current maintenance capacity, though the recent push and releases partly compensate.
There are no open issues or pull requests and no issue or pull-request activity in the last month. The clean queue is mildly positive, but the lack of activity provides little evidence of an engaged maintenance community.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
contao/core-bundle Version ^5.0 || ^6.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.