graftcode/hypertube-php-sdk

Dependency profilecaution

The package declares seven runtime requirements, including FFI, ZIP, cURL, and HTTP client components. This is a meaningful integration surface and platform requirement set, but not by itself evidence of poor package health.

Lifecycle scriptscaution

Composer post-install and post-update scripts download LFS files and extract bundled packages during installation. That behavior is central to this package's distribution model but gives installation-time code and network activity greater supply-chain impact than a passive library.

Repo bus factorcaution

One contributor made all 16 commits in the last 3 months, creating a concentrated maintenance dependency. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used as a build tool, which supports reproducible package handling, but no security scanning tool is reported. The missing scanning is a transparency and maintenance gap rather than evidence of maliciousness.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This matters for a package that downloads and extracts components during installation.