hfo4/cloudreve

Release historydanger

The package has had no registry release in about seven years, with zero releases in the last 12 months. This is a substantial maintenance and freshness concern despite recent activity in the linked repository.

Lifecycle scriptscaution

The package runs both post-create-project-cmd and post-install-cmd scripts, increasing install-time behavior and supply-chain exposure. Such scripts may be necessary for this application, but they deserve extra scrutiny when the registry release is old.

Repo bus factorcaution

Three contributors were active recently, but one contributor made about 91% of commits. That concentration leaves maintenance dependent on one person, even though the project has additional recent contributors.

Repo toolingcaution

No build or security-scanning tools were detected in the repository. That is a hygiene gap for a substantial application, although it is not evidence of abandonment by itself.

Version stabilitycaution

The assessed version is a prerelease alpha, which signals limited stability and makes it a weaker dependency choice than a stable release. The prerelease share is not dominant, so this is a moderate concern rather than a standalone failure.