aboleon/metaframework

Licensecaution

The manifest declares a proprietary license while the artifact and repository license files are recognised as MIT, so the licensing terms are inconsistent and need verification.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, adding execution during installation and therefore some supply-chain exposure for consumers.

Repo bus factorcaution

All 3 recent commits came from one contributor, leaving maintenance dependent on a single active developer.

Repo commit activitycaution

The repository received 3 commits in the last 3 months, confirming recent activity but indicating a modest maintenance pace for a frequently released package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest verification gap.