golivehost/php-qrcodegen

Package scaffoldingdanger

The artifact includes a substantial README and release notes, which improve adoption transparency. However, those notes explicitly document disabling TLS certificate and hostname verification for outbound QR-code requests, creating a serious safety concern for a network-dependent library.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, with the last push in March 2025. That is strong evidence of stalled maintenance for a package consumers may need to rely on.

Release historycaution

The package has had no release in the last 12 months, despite being about 623 days old; its three releases were concentrated in roughly two days. This indicates a largely inactive release process.

Repo popularitycaution

The repository has only 3 stars, 1 fork, and 1 watcher. Low attention is not decisive for a small package, but it provides little supporting evidence of broad review or community maintenance.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, especially for a library that makes outbound network requests.