This is a generally healthy, actively maintained release: the package has existed for about 4 years and 10 months, has 45 releases including 6 in the last 12 months, is on a stable non-prerelease version, is not deprecated, and its repository is active and not archived. The main concerns are a highly concentrated contributor base, no repository tests or changelog, absent security policy and security scanning, workflows without top-level token permissions, and a repository that neither matches the package name nor mentions it in its README. These issues warrant review before adoption, but the strong release cadence, recent commits, organization backing, and clean workflow-risk findings make the package a reasonable dependency rather than an abandonment concern.
78%
Total Score
75
100
78
80
The package has a substantial README, but neither the artifact nor repository contains tests or a changelog. The README documents module architecture and usage, yet the missing validation and change-history artifacts reduce transparency.
Two contributors were active, but the top contributor made 13 of 14 commits, or about 93%. The organization backing provides some handoff capacity, yet current activity remains highly concentrated.
There are 16 open issues, no new or closed issues in the last month, and 4 pull requests merged in that period. Recent merge activity is positive, but the unresolved issue backlog and lack of issue movement warrant some caution.
The repository name does not match the package name and its README does not mention the package, creating uncertainty that the linked repository is the canonical source for this release. Organization ownership and the substantial matching module file tree provide some context but do not remove the transparency gap.
The repository has only 3 stars and 7 forks, indicating limited visible adoption. Popularity is supporting evidence rather than a verdict, so this is not a major health failure.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
thelia/installer Version ^1.6 | — | — |
thelia/short-code-module Version ^3.0 | — | — |
thelia/thelia-library-module Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.