It includes tests, release notes, a license, and a security policy. Adoption is still a liability because the registry marks the package abandoned and its source repository is archived, with no releases in the last 12 months.
10%
Total Score
50
50
100
Packagist marks the entire package as abandoned, with no replacement specified. This is a direct warning against taking a new dependency and is not limited to this release.
The package has had 9 releases since October 2024, but none in the last 12 months and the latest release was about 18 months before collection. This supports the abandonment concern.
The linked repository is archived, despite being pushed in June 2026, so it is no longer an active maintenance target. That sharply increases abandonment risk.
Only 2 commits from 1 active maintainer were recorded in the last 3 months. The organization backing provides some handoff capacity, but the observed activity remains very low.
The audit found a high-confidence bot-conditions issue, 8 of 9 action references unpinned, and one workflow file failure. The pull_request_target workflow has no untrusted checkout or script injection, which limits the immediate risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nesbot/carbon Version ^2.67|^3.0 | — | — |
illuminate/http Version ^11.0|^12.0 | — | — |
illuminate/cache Version ^11.0|^12.0 | — | — |
illuminate/queue Version ^11.0|^12.0 | — | — |
illuminate/redis Version ^11.0|^12.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.