hoaaah/start-your-up

Release historydanger

This is the only release, published nearly nine years ago, with no releases in the last 12 months. That strongly limits evidence of ongoing maintenance, although the repository was pushed more recently.

Licensecaution

The artifact contains a license file and the repository also has one, but the detected MIT text does not match the manifest’s BSD-3-Clause declaration. The package is licensed, yet the mismatch requires clarification.

Lifecycle scriptscaution

The package runs a post-install command, adding installation-time behavior that deserves review. No other provided signal shows that this script is unsafe, so this is a moderate supply-chain hygiene concern rather than a severe finding.

Repo commit activitycaution

There were no commits in the last three months and no active maintainers in that period. The repository’s recent push and non-archived status provide some context, but not evidence of current development.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are configured. This is a transparency and maintenance gap, not proof of a security defect.