Risky to adopt despite an active, organization-backed repository. The package is well documented and maintained, but its detected identity overlap with yiisoft/yii2-composer is a serious dependency-selection concern that should be resolved before use.
45%
Total Score
100
89
100
The package is flagged as borrowing the identity of yiisoft/yii2-composer, which has far more monthly downloads; although artifact overlap is 0.0 and the README does not identify it as that package, the identity signal is a serious adoption risk because consumers may have selected the wrong dependency.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
yiisoft/yii2 Version ~2.0.39 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.