Healthy and reasonable to adopt, with strong documentation, tests, licensing, and a current release cadence. The main caveat is that the project is young and all recent repository commits come from one contributor, though organization backing and active releases reduce the abandonment risk.
82%
Total Score
80
100
94
90
The package uses a post-autoload-dump install lifecycle script. This adds install-time behavior that deserves review, but the signal provides no evidence that the script is dangerous.
All recent commits come from one contributor, creating a high bus-factor risk. Organization ownership provides some handoff capacity, which keeps this as a caution rather than a severe abandonment signal.
The repository had one commit in the last 3 months from one active maintainer. The current release cadence is strong, but the limited recent commit volume provides only modest evidence of sustained maintenance capacity.
The repository has zero stars, forks, and watchers, so there is little evidence of external adoption or community visibility. Popularity is supporting evidence only, and the package's active release and project signals compensate for this weakness.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nesbot/carbon Version ^2.67|^3.0 | — | — |
illuminate/http Version ^10.48|^11.0|^12.0|^13.0 | — | — |
guzzlehttp/guzzle Version ^7.2 | — | — |
illuminate/routing Version ^10.48|^11.0|^12.0|^13.0 | — | — |
illuminate/support Version ^10.48|^11.0|^12.0|^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.