topthink/think
the new thinkphp framework
60%
Total Score
67
90
50
Health Score Breakdown
The package runs a post-autoload-dump install-time script. No maliciousness is inferred, but any install-time execution increases the review surface for a dependency.
The package has 80 releases over more than 10 years, but no releases in the last 12 months and its latest release was in July 2025, indicating a meaningful slowdown.
The repository recorded no commits and no active maintainers in the last 3 months, which supports the concern that current maintenance has stalled.
There were no new or closed issues or pull requests in the last month, while 127 issues remain open; this is consistent with limited recent project activity.
No security policy was found in the linked repository, leaving vulnerability-reporting and response expectations unclear.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2022-45982 topthink/think is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 6.1.1. | 0.0.0 - 6.1.1 | Critical |
CVE-2020-17952 topthink/think is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 6.0.9. | 0.0.0 - 6.0.9 | Critical |
Package versions
Maintainers
 liu21st |
| yunwuxin |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 topthink/framework Version ^8.0 | — | — |
topthink/think-orm Version ^3.0|^4.0 | — | — |
topthink/think-filesystem Version ^2.0|^3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.