jarir/nemesis-framework

Dependency profilecaution

The package declares 26 runtime dependencies and no dev dependencies, creating a relatively broad runtime supply-chain and compatibility surface. This is a meaningful review concern, despite the README describing the framework as zero-dependency.

Lifecycle scriptscaution

The post-create-project-cmd install-time script adds execution behavior during project creation and should be reviewed before adoption, although the signal does not establish that the script is unsafe.

Project backingcaution

The source repository is owned by an individual user rather than an organization, so the concentrated contributor pattern is not offset by visible organization-level maintenance backing.

Repo bus factorcaution

Recent work is concentrated at 87.1% in one contributor, which creates continuity risk. A second contributor is active with 4 of 31 commits, partially reducing but not eliminating the concentration concern.

Repo issue activitycaution

There are no open issues or pull requests and no issue or pull-request activity in the last month. This is ambiguous—possibly reflecting a small or quiet project—so it provides little evidence of community support rather than a severe maintenance failure.