This is a small, long-lived MIT-licensed PHP API wrapper with a clear README, a compact and coherent package tree, no install-time lifecycle scripts, stable versioning, and no registry deprecation. The linked organization-owned repository is not archived and shows recent release and commit activity, but maintenance capacity is thin: only one release occurred in the last 12 months, there is one active contributor with all recent commits, and the package and repository contain no tests or changelog. The absence of a security policy and security scanning further reduces transparency, although the package's minimal scope and organization backing partially mitigate the single-maintainer risk. It is usable with caution rather than an obviously unsafe dependency.
68%
Total Score
70
100
83
90
Only one account has registry publish access, which is a concentration risk; however, the repository is organization-owned, making a short registry maintainer list less concerning than it would be for an individual-owned project.
A substantive README documents installation, usage, and contribution steps, but neither the artifact nor repository contains tests or a changelog. For a small API wrapper this is a real maintenance and verification gap.
The package has existed for roughly 11.6 years with nine releases, but only one release occurred in the last 12 months and the median release interval is about 319 days. This indicates continuity but slow maintenance cadence.
All recent commits came from one contributor, creating a high individual concentration risk. Organization ownership provides some potential handoff capacity, but no second active contributor is evidenced.
There was one commit from one active maintainer in the last three months, showing current activity but very limited maintenance throughput.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.