atendwa/kitambulisho

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding some execution risk for consumers. The signal does not show that the script is harmful, so this is a limited hygiene concern.

Maintainerscaution

Only one registry account has publish access, limiting publishing redundancy. The linked repository is also owned by the same individual, so there is no organization-backed maintainer base to offset that concentration.

Project backingcaution

The package and repository are owned by the same individual account, showing consistent ownership but no organizational backing to provide additional maintenance capacity.

Release historycaution

The package has had no registry release in over a year, with no releases in the last 12 months after four releases clustered in July 2025. This points to slowing maintenance, although the repository was still pushed more recently.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the registry's lack of releases over the same broad period, this is a meaningful maintenance risk.