Risky to adopt without taking on maintenance risk: the package has had no release or repository commits for about 2 years and 4 months. It is not deprecated or archived, but the single-person project has little evidence of ongoing support.
42%
Total Score
38
100
72
88
The latest release was published about 2 years and 4 months ago, with no releases in the last 12 months. Five releases clustered within roughly a day show an initial publication burst but no continuing maintenance.
The repository recorded zero commits and zero active maintainers over the last three months. Combined with the old latest release, this is strong evidence that ongoing maintenance is absent.
Only one registry account has publish access. That is a limited publishing base for a user-owned project and increases continuity risk if the maintainer becomes unavailable.
The repository is owned by the same individual account as the registry namespace, confirming consistent ownership but no organizational backing. This leaves the project dependent on a single maintainer.
There were no new issues or pull requests in the last month and no merged pull requests. The unknown open-issues count prevents stronger conclusions, but the observed lack of collaboration does not provide maintenance reassurance.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
omnipay/common Version ^3.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.