It has a clear Apache-2.0 license, tests, a matching organization-owned repository, and no install-time scripts. Treat it as a young supporting package rather than a proven long-term dependency.
68%
Total Score
75
100
86
83
The package is only 0 days old, with two releases published within minutes of each other. This provides too little history to establish a dependable maintenance pattern.
No commits or active maintainers were observed in the prior three months. Because the package was released only minutes earlier, this is primarily an unproven-maintenance signal rather than evidence of a collapsed project.
The repository uses Composer for builds, which is appropriate for the package. No security scanning tools were detected, leaving a modest security-process gap.
The repository has no security policy. For a newly published package this reduces disclosure transparency, although it is not by itself evidence of unsafe code.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/psr7 Version 3.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.