Risky to adopt: the latest release is over seven years old and the repository has had no recent commits, with only one maintainer and minimal community activity. It is licensed, documented, and not deprecated or archived, but the long-standing inactivity makes abandonment a serious concern.
38%
Total Score
25
79
75
The package has had no releases in the last 12 months, and its latest release was published over seven years ago. This strongly indicates that maintenance has stopped, despite the short initial release interval.
The repository recorded zero commits and zero active maintainers in the last three months, consistent with the extended release gap. No provided activity signal compensates for this inactivity.
Only one registry account has publish access, leaving the release process dependent on a single person. The linked repository is user-owned rather than organization-backed, so there is little evidence of broader maintenance capacity.
The repository has one star, one fork, and no watchers, providing very little evidence of community adoption or backup support. Popularity is supporting evidence rather than decisive on its own, but it reinforces the maintenance concern here.
The repository has no security policy. This is a transparency gap, although the package's long-term inactivity is the more consequential concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
topthink/framework Version 5.1.* | — | — |
workerman/workerman Version ^3.5 | — | — |
topthink/think-installer Version ^2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.