kimcastle/cmf

Release historydanger

The package has only one release, published about 6 years 9 months ago, with no releases in the last 12 months. This is strong evidence of abandonment risk despite the package not being deprecated.

Dependency profilecaution

Seven runtime dependencies create a substantial maintenance surface for a package whose sole release is years old. The signal does not show that these dependencies are unsafe, but their ongoing compatibility is harder to trust without recent releases.

Maintainerscaution

Only one registry account has publish access. With no evidence of organization backing and no recent release activity, this leaves a thin publishing base and increases continuity risk.

Repo popularitycaution

The repository has zero stars and forks and only one watcher. Popularity is not decisive, but these counters provide little supporting evidence of an active user or contributor community.

Repo toolingcaution

Composer is used for builds, which is appropriate, but no security scanning tools are present. That is a hygiene gap, and it matters more alongside the long period without maintenance evidence.