blendhtml/components

Maintainerscaution

Only one account has registry publish access, leaving little visible publishing redundancy. The linked repository is user-owned rather than organization-owned, so there is no provided evidence of broader organizational backing.

Package scaffoldingcaution

The artifact has no README, tests, or changelog, which limits consumer guidance and verification. The exact version does have GitHub release notes, providing some documentation for the change.

Repo toolingcaution

Composer is used as the build tool, which fits the package ecosystem. No security-scanning tooling is present, leaving a modest verification gap for a young package.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although the package appears to contain static templates and related assets.

Version stabilitycaution

v0.4.0 is not a stable major release, so its API may still change. It is not marked as a prerelease, which partly offsets the risk.