dmk/mklib

Lifecycle scriptscaution

A post-autoload-dump lifecycle script runs during installation. This adds execution during dependency setup and warrants care, but the signal does not show a dangerous script or an unusual number of lifecycle hooks.

Repo bus factorcaution

One contributor made 100% of the five recent commits. Organization backing reduces the risk somewhat, but no second active contributor is visible in this period.

Repo commit activitycaution

Five commits were made in the last 3 months, showing current activity. However, all recent activity comes from one active maintainer, limiting observable maintenance depth.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a modest supply-chain hygiene gap, not evidence that the package is unsafe by itself.

Security policycaution

The repository has no published security policy. That reduces transparency for reporting and handling vulnerabilities, though it does not demonstrate a maintenance failure on its own.