Usable with caveats: the package is actively released, licensed, and backed by a current repository with substantial recent pull-request activity. It is only 38 days old, maintenance is concentrated in one contributor, and its workflows use write permissions without a security policy.
68%
Total Score
67
79
50
The package runs post-install and post-update Composer scripts, adding install-time behavior beyond ordinary file delivery. This warrants review before adoption, even though the package is explicitly a QA tooling wrapper.
The artifact has no README, which is a modest consumer-documentation gap, though tests and changelog files are not expected in a published tooling wrapper. The repository does contain a README according to the related repository evidence.
The package is young at 38 days, but it already has 6 releases, including one within minutes of collection, with releases about every 11 days. This supports active early maintenance while leaving long-term maturity unproven.
One contributor made 100% of the recent commits, creating a clear single-maintainer dependency. The individual-owned repository provides no demonstrated organizational handoff capacity to compensate for that concentration.
There were 3 commits in the last 3 months, all from one active maintainer. Work is ongoing, but the low commit volume and concentration limit maintenance resilience.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
rector/rector Version ^2.6.7 | — | — |
mockery/mockery Version ^1.6.15 | — | — |
phpstan/phpstan Version ^2.2.14 | — | — |
phpunit/phpunit Version ^13.3.4 | — | — |
infection/infection Version ^0.35.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.