The package has had no release for over seven years and no commits in the last three months. Its license metadata conflicts with the MIT license file, while the repository remains available and the package includes clear usage documentation.
48%
Total Score
25
100
67
75
The latest release was over seven years ago, with no releases in the last 12 months and only two releases overall. This is strong evidence of a stagnant release line for a runtime websocket library.
The repository recorded zero commits and zero active maintainers in the last three months. The repository is not archived, but current activity does not show ongoing maintenance.
The artifact declares Apache-2.0, while the license file is detected as MIT; the repository also contains a license file. The package is licensed, but the mismatch reduces clarity for adopters.
There is one open issue and no new or closed issues or pull requests in the last month. This adds modest evidence of limited activity but is less significant than the release and commit history.
Composer is used for the build, which fits the package ecosystem. No security scanning tools are present, a minor hygiene gap that is outweighed by the more important maintenance concerns.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
workerman/workerman Version ^3.5 | — | — |
workerman/gateway-worker Version ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.