ankane/rdkit

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts download or check a shared library during installation, adding supply-chain and reproducibility exposure beyond ordinary library loading.

Maintainerscaution

One registry maintainer is consistent with a user-owned project, but it leaves the package dependent on a single publisher for release continuity.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a concrete sign that maintenance has recently gone quiet.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tools are configured; this is a modest repository hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting expectations unclear for a library that downloads a native shared library.