atoolo/deployment-bundle

Lifecycle scriptscaution

A post-install-cmd script runs during installation, which expands install-time behavior and warrants inspection even though this signal alone does not show that it is unsafe.

Release historycaution

Only two releases have appeared over about 27 months, with one release in the last 12 months and a roughly 20-month median interval. This suggests a slow-moving project, though the recent 1.1.0 release provides some evidence of ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the preceding three months. This conflicts somewhat with the recent repository push and release evidence, but still lowers confidence in sustained development activity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent than expected. The organization-backed repository and package-specific source tree partly reduce that concern, but do not remove it.

Security policycaution

No security policy was found in the repository. This is a modest transparency gap for reporting vulnerabilities, not evidence that the package is unsafe.