glueful/api-skeleton

Lifecycle scriptscaution

The package runs a post-create-project-cmd lifecycle script during project creation. This is relevant operational and supply-chain exposure for a starter package, although the single named script is not by itself evidence of an unhealthy release.

Maintainerscaution

Only one registry account has publish access. This is a limited publishing base, but the repository is owned by the Glueful organization, which provides some organizational backing rather than leaving the package entirely unaffiliated.

Repo bus factorcaution

One contributor made all 43 attributed commits in the last three months, creating a real continuity risk. The organization-owned repository offers some potential handoff capacity, but no second active contributor is shown.

Repo popularitycaution

The repository has only 1 star and 0 forks, indicating limited external adoption or review. Popularity is supporting evidence rather than a verdict, so this is a modest concern rather than a severe risk.

Repo toolingcaution

Composer is used as a build tool, which fits the package ecosystem, but no security scanning tools are configured, leaving a security-hygiene gap.