drupal/core-utility

Licensecaution

The manifest declares GPL-2.0-or-later and the artifact includes a recognized GPL-2.0 license file, so licensing is present; the detected and declared forms do not match exactly.

Repo bus factorcaution

All recent repository commits came from one contributor. Organization backing provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

Only one commit from one active maintainer was observed in the last three months, which is thin evidence of ongoing maintenance despite the recent release activity.

Repo toolingcaution

Composer is used for builds, but no security scanning tooling was detected, leaving a transparency and maintenance-hygiene gap.

Security policycaution

The linked repository has no security policy, reducing transparency about vulnerability reporting and response expectations.