digital-marketing-framework/typo3-core

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script, which adds install-time execution and therefore some supply-chain exposure. No evidence here shows that the script is unsafe, so this is a limited concern rather than a severe risk.

Package scaffoldingcaution

The artifact and repository include tests, and this exact version has GitHub release notes describing a change. The missing package README is a transparency gap for a library consumers must integrate, while the absent changelog is compensated by the release notes.

Repo bus factorcaution

All recent repository commits came from one contributor, giving a 100% top-contributor share. Organization backing provides some handoff potential, but no second active contributor is shown in this period, so the concentration remains a concern.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, with one active maintainer. Despite the recent release cadence, this thin observed development activity creates a real risk that maintenance capacity is limited.

Security policycaution

No repository security policy was found. For a framework component, the absence of documented vulnerability-reporting guidance reduces security transparency, although scanning tools provide partial operational compensation.