esikat/v3-support

Lifecycle scriptscaution

The package runs post-install and post-update scripts, which adds execution during dependency operations and warrants extra review even though this is not evidence of malicious behavior by itself.

Maintainerscaution

Only one registry account has publish access. This is not proof of weak project maintenance, but combined with zero recent repository activity it increases continuity risk.

Project backingcaution

The repository is owned by a GitHub user rather than an organization, providing less visible institutional backing; the active release history partly compensates for this.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that maintenance may have slowed or stopped.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a project-level hygiene gap.