chappy-php/chappy-php-framework

Dependency profilecaution

The package declares 20 runtime dependencies, including substantial framework, database, mail, asset, and testing-related components. This broad dependency surface increases maintenance and update exposure.

Lifecycle scriptscaution

The package runs a post-install command during installation. Install-time execution expands the trust required from consumers and is a supply-chain hygiene concern.

Maintainerscaution

Only one registry account, Chad Chapman, has publishing access. The linked repository is user-owned rather than organization-owned, so there is no shown organizational handoff capacity to offset this concentration.

Repo bus factorcaution

One contributor made 100% of the 224 commits in the last 3 months. With user ownership and no second active contributor shown, the bus factor is weak.

Repo commit activitycaution

The repository recorded 224 commits in the last 3 months, all from one active maintainer. The volume is reassuring for current activity, but it does not reduce the continuity risk of relying on one contributor.