gcordon/sheet-excel-import

Release historydanger

The latest release was about six years ago, with no releases in the last 12 months. This is strong evidence of stale distribution maintenance, although the repository was pushed more recently.

Repo package mentiondanger

The repository name does not match the package name and its README does not mention the package. That makes the package-to-source relationship difficult to verify and is a concrete transparency concern.

Project backingcaution

The package and repository are associated with individual-user accounts rather than an organization. This is not inherently unhealthy, but it provides less visible institutional backing for a package with stale releases.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. Combined with the old registry release, this raises current maintenance risk, though the repository was pushed about two years ago.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected. The missing scanner is a modest transparency gap rather than evidence that the package is unsafe.