h2sf/events

Licensedanger

The manifest declares a proprietary license, with no detected license text or license file in the package or repository. That creates a real reuse and transparency concern for an open-source dependency.

Maintainerscaution

Only one registry account, H2S, has publish access. The repository owner is a user account rather than an organization, so there is limited visible publishing redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This contrasts with recent registry releases and weakens confidence that source maintenance is continuing.

Repo toolingcaution

Composer is used for the build, but no security-scanning tooling is present. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. For a small event-management library this is not decisive, but it leaves no documented process for reporting or handling vulnerabilities.