homevip/token

Release historydanger

The package has only two releases, with none in the last 12 months, and the latest was about five years ago. This is strong evidence of abandonment risk for a dependency, though the stable major version and focused scope partly reduce the concern.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, but there is no observed recent maintenance to compensate.

Repo toolingcaution

Composer is used as the build tool, which fits the package ecosystem, but no security scanning tools were detected. This is a modest transparency and maintenance weakness rather than a severe risk.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. The package's small scope and clear licensing do not compensate for this process gap.