This release is usable but carries meaningful maintenance and transparency concerns. It has a stable v1.4.0 line, 58 releases over roughly 4.8 years, a non-deprecated registry status, a matching source repository, and no install-time lifecycle scripts. However, the repository shows no commits or active maintainers in the last 3 months, has no tests, changelog, security policy, or security scanning, and the package has no declared or file-based license. A single registry publisher and very low repository popularity further limit evidence of sustained project support, so depend on it only if its functionality is important and you can accept or mitigate maintenance risk.
58%
Total Score
33
50
72
88
No declared license and no license file were found in the artifact or repository. This is a genuine adoption and transparency concern because downstream users may lack clear permission to use, modify, or redistribute the code.
There were 0 commits and 0 active maintainers in the last 3 months. This is the strongest maintenance concern in the assessment because it suggests current development has stalled, even though the registry shows recent releases.
Seven runtime dependencies, including Laravel, Twig, helper packages, HTML utilities, and HTML Purifier, create a relatively broad dependency surface for a small rendering package. This is a manageable but real compatibility and transitive-maintenance consideration.
Only one registry account has publish access. That limits publishing redundancy, although this administrative signal does not establish actual maintenance activity or prove abandonment.
The package has a substantial README, but neither the artifact nor repository contains tests or a changelog, leaving behavior and release-history verification weaker. The README documents the package's Laravel rendering purpose, but does not compensate for the absent validation artifacts.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
laravel/framework Version * | — | — |
rcrowe/twigbridge Version * | — | — |
wongyip/html-tags Version * | — | — |
wongyip/phphelpers Version * | — | — |
ezyang/htmlpurifier Version ^4.17 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.