crgao/ip2region

Licensecaution

The package declares Apache-2.0 and includes a license file, but the artifact also contains detected MIT license text not covered by the declaration. That mismatch makes licensing less clear for adopters.

Release historycaution

Only one release exists, published in November 2018, with no releases in the last 12 months. This is strong evidence of abandonment risk for a dependency, although the package is not marked deprecated.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no activity since November 2018.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. That reduces ongoing visibility into dependency and build risks.

Security policycaution

The linked repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This compounds the package's otherwise weak maintenance evidence.