This release appears generally healthy and usable: it is MIT-licensed, stable, non-deprecated, backed by a non-archived repository, and has strong artifact documentation, tests, and changelog coverage. The package has released 36 times in the last 12 months and published v8.5.0 recently, but the repository records no commits or active maintainers in the last three months, creating a maintenance-consistency concern despite the recent release. Low repository adoption, absent security scanning and security policy, and a single registry maintainer further limit transparency, though these concerns do not outweigh the package’s substantial documentation, testing, and release history.
78%
Total Score
50
50
89
90
Nine runtime dependencies, including RabbitMQ, logging, UUID, and cryptographic components, create meaningful transitive maintenance exposure, but the profile is consistent with the package’s event-driven microservice functionality.
Only one registry account, Awescode GmbH, has publish access. This limits publishing redundancy, although registry access records do not establish who actively maintains the code.
The repository is owned by an individual GitHub user rather than an organization, so the project has limited visible institutional backing. This is a modest continuity concern, not a conclusion about maintenance quality.
There were zero commits and zero active maintainers in the last three months, which conflicts with the recent registry release and suggests that ongoing maintenance activity may be thin or release-driven.
The repository has only 4 stars, 0 forks, and 1 watcher, indicating limited external adoption and review. Popularity is supporting evidence rather than a decisive health measure, so this is a modest concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/log Version ^1.0 || ^2.0 || ^3.0 | — | — |
ramsey/uuid Version ^3 || ^4 | — | — |
league/statsd Version ^2.0 | — | — |
spatie/crypto Version ^2.0 | — | — |
monolog/monolog Version ^2.0 || ^3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.