helgesverre/brandfetch-sdk

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. Composer lifecycle scripts add execution surface during installation, although this signal alone does not show harmful behavior.

Maintainerscaution

One registry maintainer publishes the package. The linked repository is also owned by that individual, so this is a real bus-factor concern rather than merely a short registry access list.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational backing to offset the single-maintainer risk.

Release historycaution

The package is over three years old but has only five releases, with one release in the last 12 months and a median interval of about 141 days. This indicates a modest maintenance cadence rather than an abandoned package.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection. The April release provides some recent evidence of work, but the current pause lowers maintenance confidence.