This is a usable but relatively young package with a stable MIT release, active registry publishing, a substantive source tree, and clear organization-backed repository ownership. However, the repository shows no commits or active maintainers in the last 3 months, has no tests, changelog, security policy, or security scanning, and has no adoption indicators; the bursty release history partly offsets but does not eliminate the maintenance and transparency concerns. It is reasonable for projects that accept a small, organization-maintained dependency, but it warrants continued monitoring before becoming a critical dependency.
65%
Total Score
63
100
83
90
Only one registry account has publish access, which is a modest continuity risk. This is partly compensated by the repository being owned by an organization rather than an individual account.
A README is present, but neither the package nor repository contains tests or a changelog. For a library providing compilation, routes, CLI commands, and integration behavior, the absence of both tests and release documentation is a genuine maintenance and transparency gap.
The repository records zero commits and zero active maintainers in the last 3 months, which is the clearest maintenance concern. Recent registry releases and a recent repository push compensate partly, but do not demonstrate sustained source-level activity.
There are no open issues or pull requests and no issue or pull-request activity in the last month. This may reflect a small, low-traffic project, but it provides little evidence of an active user or maintainer feedback loop.
The repository has zero stars, forks, and watchers, providing no independent adoption evidence. Popularity is supporting evidence rather than a verdict, so this is a modest caution for a young package rather than a severe risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
matthiasmullie/minify Version 1.3.75 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.