ghijk/cp-notifications

Licensecaution

The manifest declares a proprietary license, with no detected license text or license file. That creates a real licensing barrier for developers seeking an open-source dependency.

Release historycaution

This is a 38-day-old package with only one release, so there is not enough release history to demonstrate sustained maintenance. Its recent first release is consistent with a new project rather than abandonment.

Repo bus factorcaution

All recorded commits in the last three months came from one contributor, leaving no demonstrated backup maintainer. The repository owner is an individual, so there is no organizational backing shown to offset that concentration.

Repo commit activitycaution

Only one commit was recorded in the last three months, with one active maintainer. For a package released 38 days ago this is limited evidence of continued maintenance, but it does not yet show a long-term collapse.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence of unsafe code.