The package includes tests, a changelog, a matching repository, and no install-time scripts. Its single maintainer, absent security policy, and very small repository audience add ongoing maintenance risk.
58%
Total Score
50
100
78
75
Only one registry maintainer is listed, leaving limited publishing continuity if that person becomes unavailable. The repository is user-owned rather than organization-backed, so no provided signal compensates for this thin base.
The package namespace and repository owner are different user accounts, and the repository is user-owned. This does not invalidate the link, but it provides no organizational backing to offset the thin maintainer base.
The package has 27 releases but none in the last 12 months, and its latest release was in February 2023. This long period without a release lowers confidence in active maintenance.
There were no commits or active maintainers in the last three months, and the repository was last pushed in February 2023. This is a material abandonment risk, though the repository is not archived.
The repository has zero stars and forks and one watcher. Popularity is only supporting evidence, but this provides little external validation for a package with otherwise inactive maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/support Version >=9.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.