Documentation, tests, and release notes are strong, and the package is clearly licensed. Its security process and workflow pinning need improvement before relying on it for a critical integration.
68%
Total Score
50
100
88
83
Only one registry account has publish access. Because the repository owner is a user rather than an organization, there is no provided backing evidence to offset this concentration.
The registry namespace and repository owner match, but the owner is a user account rather than an organization; this supports package identity without providing evidence of broader institutional backing.
The package is only 37 days old with two releases, so its maintenance record is still too short to establish long-term stability.
One contributor made all commits in the last three months, leaving maintenance highly concentrated and creating a meaningful continuity risk for this young project.
Only two commits were recorded in the last three months, indicating limited observed maintenance activity; the recent release partially offsets the concern but does not establish an ongoing cadence.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^2.0|^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.