This is a usable, stable package with a multi-year release history, a current non-prerelease version, no registry deprecation, a linked non-archived repository, and a small dependency footprint. However, maintenance capacity and project maturity appear limited: the repository has only two stars, one maintainer, no commits or active maintainers in the last 3 months, no tests or changelog, no security policy or security scanning, and no workflow automation. The repository also does not match the package name or mention it in the README, which weakens transparency about the source backing the published package. Depend on it with moderate caution, particularly if ongoing compatibility and rapid security response are important.
62%
Total Score
38
100
78
83
The repository recorded 0 commits and 0 active maintainers in the last 3 months. Despite the repository being non-archived, this is direct evidence of currently weak maintenance activity.
Only one registry account has publish access. This is a meaningful continuity risk for a user-owned project because release and maintenance capacity may be concentrated in one person.
A substantive README and GitHub Releases provide some documentation and release transparency, but the package and repository have no tests or changelog. For a small bundle this is a genuine maturity gap rather than a consumer-ergonomics issue alone.
The source repository is owned by an individual account rather than an organization, so the single-maintainer and low-activity concerns are not compensated by visible organizational backing.
There is one open issue and no new or closed issues or pull requests in the last month, indicating little observable community activity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
contao/core-bundle Version ^5.3 || ^6.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.