The package has a clear README, matching repository, MIT license, and no install-time scripts. Its small audience, single publisher, absent security policy, and years without maintenance leave substantial compatibility and bug-fix risk.
40%
Total Score
38
50
78
75
The package has made no release in nearly four years: its latest release was September 26, 2022, and it had zero releases in the last 12 months. This is strong evidence of abandonment risk.
There were zero commits and zero active maintainers in the last three months, with the repository last pushed in September 2022. This indicates maintenance has effectively stopped and creates substantial abandonment risk.
The package declares 15 runtime dependencies and no development dependencies. That is a relatively broad runtime surface for a small bundle and increases compatibility and upkeep burden.
Only one account has registry publishing access. Because the repository owner is an individual rather than an organization, there is little visible publishing redundancy if that maintainer stops maintaining the package.
The registry namespace and repository are tied to an individual account rather than an organization. That does not invalidate the project, but it provides limited visible institutional backing for long-term maintenance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nyholm/psr7 Version ^1.5 | — | — |
symfony/yaml Version ^6.1 | — | — |
symfony/config Version ^6.1 | — | — |
symfony/finder Version ^6.1 | — | — |
workerman/psr7 Version ^1.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.