aimeos/ai-cms-grapesjs

Licensecaution

The package declares LGPL-3.0, while the artifact license file was detected as LGPL-2.1; although both the artifact and repository contain license files, the mismatch reduces clarity.

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active contributor. The repository owner is recorded as a user rather than an organization, so no organizational handoff is shown.

Repo commit activitycaution

Only two commits were recorded in the last three months, with one active maintainer. This is current but thin activity for a package with ongoing releases.

Repo toolingcaution

Composer is used as a build tool, but no security-scanning tools were detected. This is a transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This lowers transparency but is not by itself evidence that the package is unsafe.