fab2s/bom

Lifecycle scriptscaution

Post-install and post-update Composer scripts add execution during dependency operations. Their presence is a supply-chain hygiene concern, although this signal does not show that the scripts are harmful.

Project backingcaution

The package and repository are owned by the same individual account, so there is no organization backing shown to compensate for the concentrated maintainer base.

Release historycaution

The package has only three releases since September 2019, with a median interval of about 3 years and 5 months; one release in the last 12 months shows recent activity but not a regular cadence.

Repo bus factorcaution

All three recent commits came from one contributor, so maintenance depends entirely on a single person despite the repository remaining active.

Security policycaution

The repository has no security policy, leaving no documented reporting process for consumers of this library.