jorgeliu/yii2-aliyun-afs

Release historydanger

The package has had only one release, with no releases in roughly 7 years and 10 months. This is strong evidence that maintenance has stopped, with no newer release history to offset it.

Repo commit activitydanger

The repository recorded no commits and no active maintainers in the last 3 months, consistent with the package's long release silence. This materially increases abandonment risk.

Licensecaution

A license file is present, but it identifies Apache-2.0 while the manifest declares MIT. The release is licensed, yet the mismatch creates avoidable legal and transparency uncertainty.

Repo toolingcaution

Composer build tooling is present, which supports reproducible project handling, but no security scanning tools were detected. For an unmaintained package, that leaves an important verification gap.

Security policycaution

The linked repository has no security policy. This is a transparency gap, especially because there is no recent activity showing that security issues are handled elsewhere.