hesabro/change-log

Release historydanger

The package has had only two releases, with none in the last 12 months; its latest release was about two years ago. This strongly raises abandonment risk, although the package is not marked deprecated.

Package scaffoldingcaution

A README is present, but its content is still the generic GitLab starter template rather than package documentation. Missing tests and a changelog are normal for a published artifact and do not lower the score here.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, which is only a limited compensating signal.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so ownership of the published artifact is not clearly established. This is a transparency concern beyond an ordinary monorepo naming mismatch.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest assurance gap rather than evidence that the release is unsafe.