Usable with caveats: the package is well documented, tested, licensed, and backed by a matching repository with strong workflow safeguards. However, it was first released today, has only two releases, no established commit history, and is maintained by one person, so its long-term reliability is unproven.
68%
Total Score
63
100
89
90
A single registry maintainer is consistent with the repository being user-owned, but it creates a limited support and succession base for a package with no operating history.
The registry namespace and repository owner match, but the owner is an individual rather than an organization, so there is no organizational continuity to offset the single-maintainer risk.
The package is brand new, with only two releases over less than one day, so there is not enough history to demonstrate sustained maintenance or release reliability.
The repository reports zero commits and zero active maintainers in the three-month window. Its newly created state explains this result, but there is still no demonstrated maintenance track record.
The repository has zero stars and forks and one watcher. For a package released today this is expected and not a severe concern, but it provides no external evidence of adoption or review.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^3.0 | — | — |
psr/http-client Version ^1.0 | — | — |
psr/http-factory Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.