adamb/shopping-cart

Dependency profilecaution

Ten runtime dependencies create a relatively broad maintenance and transitive-dependency surface for a shopping-cart library, though the dependencies are explicitly declared.

Licensecaution

The manifest declares MIT, but the artifact license file is detected as GPL-3.0; although both the package and repository contain license files, the mismatch needs resolution before adoption.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single person with no demonstrated second maintainer.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling is present, reducing automated supply-chain oversight.