The artifact is small and documented, with no install-time scripts and only one runtime dependency. It has no tests, security policy, or repository security scanning, which leaves maintenance and review gaps.
58%
Total Score
67
100
72
83
The package has had no releases in more than seven years: all four releases were published on 2019-02-15, with none in the last 12 months. This is strong evidence of inactivity for a dependency.
The artifact includes a license file, but the manifest declares OSL-3.0 while the detected license text is MIT. The package is licensed, yet the mismatch creates a legal transparency concern that should be resolved before adoption.
Only one registry maintainer is listed, and the repository is owned by an individual rather than an organization. This leaves limited visible publishing capacity and increases continuity risk if that maintainer stops responding.
The repository has no open issues or pull requests and recorded no issue or pull-request activity in the last month. With no newer release evidence, the absence of activity provides little sign of ongoing maintenance.
The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, so this modestly reduces external validation but is not decisive for a small package.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
magento-hackathon/magento-composer-installer Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.