yard/wp-database v2.0.0 appears suitable to depend on, with a stable major release, recent publication, an unarchived repository, organizational backing, tests, documented workflows, and evidence of recent pull-request activity. The main concerns are a small recent release history, only two commits from one active maintainer in the last three months, limited repository popularity, absent security policy, and broadly undeclared GitHub Actions permissions; these reduce resilience and transparency but do not indicate abandonment or an otherwise unfit release.
78%
Total Score
75
50
94
70
Six runtime dependencies create a meaningful dependency surface, including framework and data packages, but this is proportionate to a WordPress Eloquent ORM integration and is not excessive on its own.
A post-autoload-dump install-time script is present. This is a legitimate Composer integration point but increases installation complexity and warrants review because it executes during dependency installation.
One contributor made 100% of the two commits in the last three months, creating a concentrated bus factor. Organizational ownership provides some ability to hand maintenance off, but no second active contributor is shown.
Only two commits were recorded in the last three months, with one active maintainer. Recent repository activity exists, but the low volume suggests a small maintenance capacity.
The repository has zero stars and forks and only two watchers. Popularity is supporting evidence rather than a verdict, but these counters provide little external validation.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
yard/data Version ^2.0 | — | — |
roots/acorn Version ^5.0 | — | — |
jgrossi/corcel Version ^9.0 | — | — |
spatie/laravel-data Version ^4.13 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.