bear/stub-json

Repo package mentiondanger

The repository name does not match bear/stub-json, and its README does not mention that package; the published README instead identifies the project as BEAR.FakeJson and shows a different install name. This raises a concrete concern that the repository may not belong to this release.

Lifecycle scriptscaution

The package runs post-install and post-update scripts, giving it execution during dependency operations. No provided signal shows these hooks are necessary or narrowly scoped.

Release historycaution

This is the sole release, published about 8 months ago, with no subsequent release activity. That limited history makes long-term maintenance harder to establish.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. With only one registry release, this provides weak evidence of ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.