coreshop/shipping-bundle

Licensecaution

The manifest declares a proprietary license and the artifact contains LICENSE.md, with a corresponding repository license file. The release is therefore licensed, though its terms may restrict use compared with an open-source license.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Against the otherwise long release history, this indicates a recent maintenance pause and lowers confidence in ongoing responsiveness.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package. Because the repository is otherwise under the matching CoreShop organization, this is a provenance concern but not conclusive evidence of misattribution.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves a meaningful supply-chain hygiene gap for future changes.

Security policycaution

No security policy was found in the repository. This reduces transparency about vulnerability reporting and response expectations.