The package is clearly licensed, tested, and published with release notes, and its organization-backed repository includes build and static-analysis tooling. Workflow references are not pinned, and the repository does not explicitly connect its name to the package, adding adoption and supply-chain caution.
58%
Total Score
50
100
94
67
The repository recorded 0 commits and 0 active maintainers in the last 3 months. Combined with the lack of issue and pull-request movement, this is a meaningful maintenance concern despite the recent release history.
There were 26 open issues and 7 open pull requests, with no new or closed issues and no merged pull requests in the last 1 month. The unresolved queue indicates limited recent project response.
The repository name does not match the package name and its README does not mention the package. Although a name mismatch can be normal for a subpackage, the lack of any README mention leaves some uncertainty that this repository is the intended source.
The repository has no security policy, leaving reporting and response expectations unclear. This is a transparency gap, but it is partly offset by the presence of Psalm scanning.
All 16 analyzed action references are unpinned, and one high-confidence finding identifies use of an archived action; the low-confidence cache findings are hygiene only. Workflows were fully analyzed and had no untrusted checkout or script-injection findings, so this is a caution rather than a severe workflow risk.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
symfony/lock Version ^6.4 || ^7.4 | — | — |
cocur/slugify Version ^4.0 | — | — |
sylius/sylius Version ^2.1.2 | — | — |
guzzlehttp/guzzle Version ^7.9 | — | — |
akeneo/api-php-client Version ^11 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.