38%
Total Score
unhealthy
Risky: no release or repository activity since 2017, with an unclear license and minimal project safeguards.
The latest release was in September 2017, with no releases in the last 12 months despite the package being over nine years old. This is strong evidence of abandonment risk.
The package declares only two runtime dependencies and no development dependencies, which is a small dependency surface. The lack of development dependencies also provides little evidence of maintained testing or development practice.
The manifest declares “1.0.0,” which is not a recognised license, and no license file was found in either the package or repository. Consumers therefore lack clear reuse terms.
The repository is owned by an individual user rather than an organization, so there is no visible organizational backing to offset the package’s single-maintainer and inactivity concerns.
The repository has one star and no forks, providing little community evidence or external review. Popularity is supporting evidence rather than decisive on its own, but it does not compensate for the inactivity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
dekuan/vdata Version ^1.0 | — | — |
jenssegers/mongodb Version ^3.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.