jonathanpmartins/staysvel

Lifecycle scriptscaution

A `post-autoload-dump` install-time script is present. This is a limited supply-chain exposure, but the signal does not show dangerous behavior or make the package unhealthy on its own.

Registry deprecationcaution

Packagist marks the package abandoned at package scope and names `ownerpro/staysvel` as the replacement. The release notes confirm the rename and migration, so this is a real dependency concern but not evidence that the code itself is unfit.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanning is a modest hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That reduces transparency for reporting vulnerabilities, although it is partly offset by the active repository and documented project structure.