forme/framework

Dependency profilecaution

The package declares 23 runtime dependencies for a framework, creating meaningful transitive maintenance exposure, though the profile is consistent with its broad framework role.

Lifecycle scriptscaution

A post-install command runs during installation, adding execution-time supply-chain exposure beyond ordinary package extraction; no provided signal shows that this script is unsafe.

Maintainerscaution

Only one registry account has publishing access, which is a resilience concern, although the repository is owned by an organization and release activity is substantial.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which conflicts with the otherwise strong release history and raises concern about current maintenance depth.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported, leaving a security-process gap for a framework with many runtime dependencies.