Usable with caveats: the release is current, licensed, tested, and backed by an organization, but recent direct commit activity is absent. Review the project's maintenance pace and CI permissions before adopting it broadly.
72%
Total Score
75
100
94
80
One workflow uses pull_request_target, but no untrusted checkouts or script-injection patterns were detected; the workflow is limited to Dependabot auto-merge.
Only one registry account has publish access, which is a limited publishing base, though the repository is owned by an organization and therefore this is less concerning than a lone individual project.
The package has existed for 686 days with four releases, but only one release in the last 12 months and a median interval of about 161 days indicate a modest release pace.
The repository recorded zero commits and zero active maintainers in the last three months, a significant maintenance concern; this is partly offset by the same-day release and four recently merged pull requests.
Two of three workflows declare top-level write permissions, and one workflow has no top-level permissions declaration, leaving CI privilege boundaries weaker than ideal.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
filament/filament Version ^5.0 | — | — |
tomatophp/console-helpers Version ^1.1 | — | — |
tomatophp/filament-translations Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.