greenpeace/planet4-gpch-plugin-tamaro

Repo bus factorcaution

One contributor made all 6 recent commits, creating a meaningful single-maintainer continuity risk. Organization backing partly compensates because maintenance can potentially be handed off.

Repo commit activitycaution

The repository recorded 6 commits in the last 3 months and 1 active maintainer, which demonstrates recent activity but limited visible maintenance capacity.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, so it is not fully clear that the linked repository specifically backs this release.

Repo toolingcaution

Composer is used as a build tool, which supports reproducible project structure, but no security scanning tools are reported. The lack of scanning lowers assurance somewhat without outweighing the active release history.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented. This is a transparency gap, though it is not evidence that the package is unsafe.