kostyan-org/vk-archiver

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, increasing installation-time behavior that should be understood before adoption. No provided signal shows those scripts are unsafe, so this is a review concern rather than a severe risk.

Project backingcaution

The registry namespace and repository owner match, but the owner is identified as a user rather than an organization. This offers limited backing evidence and does not offset the lack of recent releases.

Release historycaution

Only three releases exist, with none in the last 12 months; the latest release was in March 2023, leaving a multi-year maintenance gap. This is the main adoption concern, though the package is not marked deprecated.

Repo toolingcaution

Composer is used as the build tool, providing standard dependency management, but no security-scanning tooling is reported. The absence of scanning is a moderate hygiene gap rather than a health verdict.

Security policycaution

The linked repository has no security policy, which weakens vulnerability-reporting transparency for a package that handles API tokens and database credentials. This is a modest hygiene gap, not evidence of abandonment by itself.