The package has a clear README, repository tests, a license, and security tooling. Its prolonged inactivity makes adoption risky; pin version 2.14.1 if you must use it.
38%
Total Score
50
88
100
The package has had no release in over five years, despite 43 releases overall and a previously regular cadence. That strongly increases abandonment risk for a dependency.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and indicating no recent maintenance capacity.
There were no new or closed issues or pull requests in the last month, while 15 issues remain open, providing additional evidence of inactive project maintenance.
All seven analyzed action references are unpinned, which weakens build reproducibility. The audit found no dangerous triggers, untrusted checkouts, script injection, or higher-severity findings, limiting this to a hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
tipoff/support Version ^2.1.5 | — | — |
drewroberts/blog Version ^4.5.4 | — | — |
tipoff/authorization Version ^2.8.6 | — | — |
tipoff/laravel-google-api Version ^2.1.1 | — | — |
sixlive/nova-text-copy-field Version ^1.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.