The package is well documented, tested, licensed, and free of install-time scripts. Its small project has no security scanning, leaving less evidence of ongoing review and maintenance capacity.
67%
Total Score
50
100
83
83
Only one registry account has publish access. That is a limited publishing base, though this administrative list does not by itself establish the project's actual maintenance capacity.
The repository owner is a user account rather than an organization, so there is no provided organizational backing to compensate for the limited registry maintainer base.
The package has existed for about 4 years 7 months but has only three releases, with a median interval of about 22 months. One release in the last 12 months shows some continued publishing, but the cadence is slow.
There were zero commits and zero active maintainers in the last three months. Although the repository was updated for the latest release, the recent development activity is limited.
There are no open issues or pull requests and no recent issue or pull-request activity. This is neutral for a quiet package, but provides little evidence of an active community.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/http-factory Version ^1.1 | — | — |
psr/http-message Version ^2.0 | — | — |
psr/http-server-handler Version ^1.0 | — | — |
tobento/service-message Version ^2.0 | — | — |
tobento/service-support Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.