karakushan/commero

Licensecaution

The manifest declares a proprietary license, with no detected license text or license file. This creates a meaningful adoption and redistribution constraint for an open-source dependency.

Release historycaution

The package is only 51 days old but has 19 releases, with a median interval of about 6 minutes, indicating rapid early development and limited evidence of sustained stability.

Repo bus factorcaution

All 34 recent commits came from one contributor, leaving little demonstrated handoff capacity if that maintainer stops work.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning reduces assurance for a package that provides commerce and administrative functionality.

Security policycaution

The repository has no security policy, so consumers have no documented process for reporting or handling vulnerabilities.