koh/sylius-mpp

Package scaffoldingcaution

The artifact has a changelog but no README; the repository compensates with tests and its own changelog. For a library, the missing consumer-facing README remains a minor transparency gap.

Release historycaution

The package is less than one day old despite 37 releases, all published within that period. This shows active initial publishing but provides little evidence of established release stability.

Repo bus factorcaution

All 23 commits in the last three months came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-owned, so no organizational handoff is evident.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. That is a maintenance and assurance gap, though it is not evidence of malicious behavior by itself.