ankane/disco

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts download or check a shared library during Composer operations, adding install-time behavior and supply-chain exposure beyond ordinary PHP loading.

Maintainerscaution

Only one registry account has publish access. The linked repository is owned by the same individual, so the narrow maintainer base remains a meaningful continuity risk.

Project backingcaution

The registry namespace and repository are both owned by the same individual rather than an organization, so there is no organizational backing to offset the small maintainer base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is concerning for ongoing support, although the recent release provides some compensating evidence.

Repo popularitycaution

The repository has 23 stars and 2 forks. This is modest supporting evidence, not enough to materially offset the limited recent activity and single-maintainer base.