gp247/s-cart

Lifecycle scriptscaution

The package runs post-autoload, post-create-project, post-install, and post-update scripts, which increases install-time behavior and warrants review before deployment.

Project backingcaution

The repository owner is a user account rather than an organization, so the small maintainer and contributor base is not visibly supported by organizational backing.

Repo bus factorcaution

Only two contributors were active in the last 3 months, and the leading contributor made about 61% of commits. That is a thin base, although the second contributor remains substantially active.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and disclosure expectations.