This is a generally well-structured, actively released package with a stable major version, 34 releases over roughly 5.6 years, three releases in the last 12 months, matching repository evidence, tests, a changelog, and no install-time lifecycle scripts. However, the repository shows no commits or active maintainers in the last three months despite the latest release, has very low popularity, and lacks a security policy and explicit workflow token permissions. It is usable as a dependency, but the limited recent development activity and security-process transparency warrant caution and periodic review.
68%
Total Score
67
50
88
80
The package declares six runtime dependencies, including its framework and template-related components, which is reasonable for its stated role but creates several transitive maintenance points.
There were 0 commits and 0 active maintainers in the last three months. Although the package has recent releases and the repository was pushed recently, the lack of observed recent development is a meaningful maintenance-risk signal.
There are 2 open issues and 1 open pull request, but no issues or pull requests were opened or closed in the last month; this indicates limited recent public interaction.
The repository has only 1 star, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these counts provide little external validation or visible community redundancy.
Composer build tooling is present, but no security scanning tools were detected. The build setup is appropriate, while the absent scanning coverage reduces supply-chain transparency.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
xp-forge/json Version ^6.0 | ^5.0 | — | — |
xp-forge/yaml Version ^9.0 | ^8.0 | ^7.0 | ^6.0 | — | — |
xp-forge/frontend Version ^7.0 | ^6.0 | — | — |
xp-framework/core Version ^12.0 | ^11.0 | ^10.0 | — | — |
xp-forge/handlebars Version ^10.0 | ^9.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.