hiddencms/core

Licensecaution

The package declares GPL-3.0-only and includes license files, but the artifact also contains detected LGPL-3.0 text that the declaration does not cover, creating a licensing ambiguity.

Lifecycle scriptscaution

The package runs post-install-cmd and post-update-cmd scripts, so dependency installation can execute package-defined actions; this is a supply-chain transparency concern even though no malicious verdict is implied.

Maintainerscaution

Only one registry account has publish access. The linked repository is organization-owned, which provides some backing, but publishing resilience still depends on a single registry maintainer.

Release historycaution

The project is only 30 days old but already has 32 releases, with a median interval of 0 days. That shows active iteration but provides little long-term maintenance history.

Repo bus factorcaution

One contributor made all 50 commits in the last 3 months. Organization ownership offers some handoff capacity, but no second active contributor is shown, so contributor concentration remains a concern.