fluffydiscord/sylius-honkers-bundle

Licensecaution

The manifest declares a proprietary license, with no detected license text or license file in the package or repository. That creates a meaningful usage and transparency concern for an open-source dependency.

Project backingcaution

The repository owner is an individual user rather than an organization. This does not establish poor maintenance, but it provides no organizational handoff capacity to offset the concentrated contributor activity.

Release historycaution

The package is only 1 day old and has already published 7 releases, with a median interval of about 1.5 hours. This shows active initial iteration but provides almost no evidence of sustained maintenance.

Repo bus factorcaution

One contributor made all 21 commits in the last 3 months, giving the project a single-person bus factor. With no organization backing shown, loss of that maintainer could materially affect continuity.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of unsafe code by itself.