esyede/rakit

Lifecycle scriptscaution

The package runs a post-create-project-cmd script during installation or project creation. This is common for frameworks but increases installation complexity and the code executed during setup.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and single-contributor concentration is not offset by visible organizational backing.

Release historycaution

The package has had no registry release in nearly five years and none in the last 12 months, despite only four releases overall. This is a meaningful freshness concern for depending on this specific release.

Repo bus factorcaution

All 107 recent commits came from one contributor, with a 100% top-contributor share. This creates a real continuity risk if that contributor becomes unavailable.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and maintenance gap rather than evidence of a specific vulnerability.