divineomega/php-ssh-connection

Registry deprecationdanger

Packagist marks the entire package as abandoned, even though the listed replacement is the same package and the latest release is recent. Package-level abandonment is a serious dependency risk because future maintenance is not assured.

Project backingcaution

The repository is owned by an individual user rather than an organization. This does not invalidate the package, but it provides no organizational handoff capacity to offset the concentrated maintenance base.

Repo bus factorcaution

One contributor made all commits in the last 3 months, giving the project a single-person active-maintenance base. The repository is user-owned, so there is no shown organizational backing to compensate for that concentration.

Repo commit activitycaution

Only one commit was recorded in the last 3 months. That is evidence of some recent maintenance, but the low volume limits confidence that maintenance is durable.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The missing scanner is a modest transparency and maintenance gap rather than evidence of unsafe code.