bitbag/product-attribute-groups-plugin

Lifecycle scriptscaution

The package declares post-create, post-install, and post-update Composer scripts. These add installation-time behavior that warrants attention, but the signal alone does not show harmful or unusual actions.

Release historycaution

The package has 10 releases since February 2022, but none in the last two years; its latest release was about two years ago. This indicates materially reduced maintenance activity.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with a repository that has been largely inactive for about two years. This increases maintenance and abandonment risk.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about the package-to-repository link. The repository's Sylius plugin context makes a subproject relationship plausible, so this is caution rather than danger.

Repo toolingcaution

The project uses Composer for builds, but no security-scanning tools were detected. This is a modest transparency and hygiene gap rather than evidence of unsafe code.