atto/membrane-module

Dependency profilecaution

Ten runtime dependencies create a meaningful transitive maintenance surface for a small package. The profile is not inherently unsafe, but it increases the cost of tracking compatibility and updates.

Licensecaution

The release declares a proprietary license, so it is licensed even though no license file was detected. This is not a missing-license gap, but the terms may restrict adoption in open-source projects.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although the recent release shows publishing activity, the lack of observed development activity lowers maintenance confidence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. A monorepo relationship may explain this, but the collected evidence does not establish that the repository is specifically for this package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest supply-chain hygiene gap rather than evidence that the package is unmaintained.